Upon doing a simple what is my IP search, I began to wonder. How does the final server keep track of my IP address and how is the request made?

A simple tracert command in Command Prompt and I can see that a request to ping the website https://whatismyipaddress.com/ goes through six different servers before it reaches it's destination.

Does each server hand off my IP address to the next server? It appears to me that asking a website for my public IP address should return the previous server's IP address, rather than mine.

  • This really isn't a security question, but without getting too deep down the rabbit hole, yes, it is passed between each. The source and destination addresses in your IP packet never change (NAT is a whole other topic). – INV3NT3D Dec 6 '16 at 19:27
  • IP packets that should be forwarded have the destination ip address, but are addressed to the desired router with the hardware address (such as MAC for ethernet). – trognanders Dec 6 '16 at 19:55

This isn't really a security question as much as a networking question. That said, if all a router could know was the next/previous router in the chain, how would the next host know who to send the packet to?

Think of network packets as you would postal mail. Imagine if the original sender put their packet into an envelope with the address of the nearest post office on it, instead of the address of the destination. How would the post office know to whom to eventually deliver your mail? Worse, imagine the letter is somehow delivered to your recipient. How do they know who to reply to? Each post office along the way would have to remember every piece of mail that went through it previously, to associate a reply back to the original sender.

Perhaps you might include nested envelopes, with each next envelope listing out each sorting facility along the way. How are you supposed to get the canonical list of hops between you and the eventual destination? What if one of those sorting facilities is overloaded, or worse, no longer operational — how can the postal system reroute your mail if it has the entire path through the system written down in every envelope? This would also be expensive and costly! Postal employees would spend a massive amount of time opening envelopes just to see to where each piece of mail needs to go. And again, what happens when the recipient wants to reply? How do they specify the routing of your mail if they don't know its eventual destination?

So if you can't just include the next hop, and it's completely impractical to include the entire list of hops, what's the answer?

Obviously, you put the destination address on the envelope along with your return address. Every hop in-between makes an independent decision about how to get your mail closer to the destination. If a new sorting facility is opened, an existing one closed, or if there's a capacity problem that can be resolved by going through a different route to the destination, the postal workers can figure out what needs to happen. If mail gets sent to the wrong facility by accident, it can still eventually arrive at its intended destination. Processing mail can be fast — there's no need to open envelopes — they can simply be passed through the system untouched. And when the recipient gets the correspondence, they can reply with a single piece of information: who it's going back to.

Unsurprisingly, this is how the Internet works. You include the destination address and the source address in every IP packet. All a router needs to do is quickly look up how best to get your packet closer to its intended recipient, and then they can statelessly forward that packet, completely unaltered, down the line to the next router.

| improve this answer | |

The server you are communicating with needs to know your IP address so it can route the response back to you. The nodes you see in a tracer[ou]t[e] are routers, but that doesn't mean they are performing Network Address Translation (NAT) like your home gateway/router probably does; the source (and destination) IPs of the packets coming out of those routers are the same as they were going in.

The purpose of a router is simply to figure out, based on the destination IP, where to send the packet. The server receives a packet with your IP as the source, and a destination IP of itself, and replies with a packet that has those reversed. It can (and usually does) also log the source IP.

Note that if the server is behind NAT (rather than having a publicly routeable IP), it will only see the source IP of the NATing gateway. In such cases, the gateway will log the original source IP, and then creates a translation rule for itself. The short version of how NAT works is that the gateway remembers that a given internal host+port combination corresponds to a given external host+port (and vice versa), and it translates packets arriving on its internal interface on that internal port (and from that internal host) to packets destined for the remembered external host.

| improve this answer | |

A traceroute works by creating a TCP ICMP packet that has a max-hop count of 1 with the final destination in the normal field of the IP header. When the pack goes from your computer's network card it will travel along the wire over switches and hubs to a router. That router will look at the max-hop count and decrease it by one, then send it along. When the count is zero it will drop the packet and send back a ICMP packet to the source, showing that the max hop count has been exceeded. The source of the packet will be the router that sent this, so you will see that router in the traceroute. Your computer will send another, with the hop counter increased by one.

'whatismyip' sites just show your public IP address from the TCP/IP session.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.