29

While testing a recent adtech integration I noticed something I can't explain. The iPhone uses two IP addresses. Seemingly one for HTTP and one for HTTPS. To further confuse things it only happens when the device is not on wifi. Although, the only carrier I've confirmed it happening with is AT&T. FWIW, this does not happen with Verizon

Can anyone explain why this would be the case?

Example: http://ipof.in/json returns a different IP address than https://ipof.in/json. They appear to be owned by the same carrier (AT&T), as well as both public, but are wildly different (107.77.212.XXX vs 166.216.157.XXX).

It's also worth noting that the response from ipof.in contains a timestamp. Nothing is being cached. I receive similar results with similar service www.ip4.com, etc.

  • Please add info about the IP addresses that were assigned. – Akber Choudhry Jun 21 '16 at 3:17
45

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address.

If this is the case, your phone has one IP address but the carrier's routing shows different origin IP addresses at ipof.in.

  • 16
    Seems like a proxy is there. I checked my request header and noticed I get Via: cncnz03msp2ts05.wnsnet.attws.com So ATT has some massive proxy that is proxy all HTTP traffic, yikes! furthermore, it's not including the X-Forwarded-For header – Greg Dean Jun 21 '16 at 7:29
  • 11
    Proxying is probably the nicest thing AT&T is doing to your unencrypted data. I would expect them to do all sorts of packet inspection and header enrichment if they can get away with it. – You Jun 21 '16 at 17:23
  • 5
    @GregDean: Your data is quite obviously already entirely going through their equipment... why does seeing a proxy header make you freak out? – Mehrdad Jun 21 '16 at 18:17
  • 2
    @GregDean: X-Forwarded-For is not intended for usage like this. The ip address it did the forwarding for is likely on a private block and thus meaningless to the server, and moreover, X-Forwarded-For cannot be trusted (and thus must be ignored/stripped by your server anyway) unless it's generated by proxy you or someone you trust controls on the server side (think load-balancing proxies like haproxy or a service like CloudFlare). – R.. Jun 21 '16 at 21:04
  • 1
    @r the IP address is likely they same IP address that is seen over HTTPS, so not private. I don't see the harm in including XFF and letting the destination server make a decision on trust. – Greg Dean Jun 21 '16 at 22:28
5

Your HTTP requests are proxied, hence the ipof.in service sees different IP addresses.

I believe this answer explains it well, but another possibility (regardless of cellular/WiFi connection) is that your browser uses a Data Saver (Chrome*) or Turbo Mode (Opera) option. Both intended to compress the data for mobile devices.


* Chrome feature seems not available anymore for iOS. It could be turned off to get consistent results. Visual instructions for old Chrome (Settings -> Advanced -> Bandwidth -> Data Saver and switch the option to Off) are here starting from slide 5.

  • That's what "another possibility" means. Try Chrome and see it works exactly the same as you described, including unique timestamps. – techraf Jun 21 '16 at 5:41
  • 1
    And the word proxying is not the same as caching. – techraf Jun 21 '16 at 6:42
  • 1
    Surprisingly this feature is no longer available on iOS not "not yet available". This is how it worked - starting on slide 5 – techraf Jun 21 '16 at 9:48
  • 2
    Wouldn't a browser proxy work the same on wifi and cell data? – Greg Dean Jun 21 '16 at 10:56
  • 1
    and exact what I mean with "it only happens when the device is not on wifi" – Greg Dean Jun 21 '16 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.