Does An IP Address Provide Useful Tracking Information?

An IP address is an address for a computer on the Internet. The usual example used is of a web server that can be accessed via a URL that is translated behind the scenes into an IP address, but IP addresses can be used to find any computer on the Internet.

When a normal home broadband user accesses the Internet they send their transmission through their Internet Service Provider (ISP) who have a collection of IP addresses they use for their users. ISPs tend to get blocks of perhaps several thousand IP addresses that they will use as a pool for their users. When a user logs on they are given an IP address and when they log off this address is sent back to the pool for other users to use. The actual systems in use here are a little bit more complex than this, but this is the essential idea.

How this works in practice is different based on which ISP the user uses to connect to the Internet as different technologies (like NAT) allow ISPs to assign the same users to the same IP addresses. Some ISPs will rotate a IP addresses amongst its users on a daily basis, whilst others will rotate them on a request by request basis so there is no guarantee that the same user will be given the same IP address.

For advanced users it is possible to spend a little bit extra to gain a static home IP address. This means that whenever they access the Internet they will always be given the same IP address, but it is usually only taken up by the advanced users as it is meaningless and useless to most. The vast majority of businesses will connect to the Internet through a static address in this way, but in this case all users will be given a single IP address according to the outside world. If the business infrastructure is good then users can be tied to requests internally, but this isn't always the case.

An added layer of difficulty comes into play when users start using proxy servers to access the Internet. This allows users to bounce their request off of a server (sometimes more than one is used) on the Internet so that from the other side they appear to be coming from a different location than they really are. This might seem like an advanced topic, but it is quite possible to get proxy tools plugins for most common browsers that allow even non technical users to mask their IP address with great ease. It is sometimes possible to detect the original IP address of the user, but only if the proxy has been set up in the correct way.

Some services will allow you to look up the physical location of a user based on their IP address, also called IP geolocation. These systems work by having a large database of IP addresses and where each one is, the amount of detail available is dependent on how much you are willing to spend on the service. The main problem with this is that a users IP address will almost certainly be the location of their ISP and not their actual physical location, so only country based information is really useful. The other issue with this sort of thing is that it isn't always completely accurate and you will find that some people you think come from one place will actually be another one.

Tracking IP addresses is therefore fraught with difficulty and should not be used as an exact science. Using cookies and session identification is a much more reliable way of tracking users in websites and this is what most affiliates and analytics sites tend to do.

I have seen lots of CMS applications that manage session information by recording IP addresses and users, killing off sessions where the user doesn't match the IP address. Most of the time this is fine, but you shouldn't completely rely on it as the same user might not come from the same IP address.

Any IP address, however, can usually be traced back to the user or computer who sent the request. Due to the fact that most users will send their request through an ISP server this will probably require asking ISPs or even businesses to reveal their internal IP address to user tracking (if they have any) and so can usually only be done by the police or those people with the correct paperwork.