4

How can I find the IP address of others on the internet, such as the IP address of someone who posted a comment on a blog post?

2
  • 1
    I've always used "$_SERVER['REMOTE_ADDR'];", assuming you run on PHP.
    – Phoshi
    Sep 11, 2009 at 20:16
  • @Phoshi, you might also want X-Forwarded-For and headers like that. (See my answer below.)
    – Arjan
    Sep 13, 2009 at 9:00

3 Answers 3

18

If it's your site, check from the administration interface whether the commenting system stores IP addresses. There's a good chance it does.

If it's not shown on the administration interface, check the database directly. The table containing comments might still have a field containing the IP, even if you can't browse it from the admin interface.

If it's not in the database at all, check the exact time of the comment, and look at the web server access logs to find a matching CGI request (probably CGI POST) - if there's only one suitable log entry at that time, there's your IP.

If the comment doesn't have an exact time anywhere in the database, use other measures to appoximate the time it was sent at, then check the web server access logs again for that timeframe to see if there's only one suitable log entry.

If you can't determine the comment time reliably enough, count the comments that have been added to that entry before and after that comment, then check what URL would be used to post a comment to that specific entry, read the web server access logs to find all matching entries, and count which one of those is the comment you're after. Make sure the count of comments matches the count of suitable log entries to be sure you're not making a mistake.

If you don't have access to the system, you can't find out. Might be worth checking out the HTML source of the page where the comment is shown if IP is for some reason just quoted out, but that's a far shot. Well, I guess you could also hack into the system, or bribe the system admin, or join up in international espionage organization, become a renowned agent they can't afford to lose, then demand your organization to covertly force the admin to show the system logs for you...

3

Not all visitors connect directly, but use a proxy server (for speed, or to hide their IP address). Some proxies add some special "HTTP header", like X-Forwarded-For, to specify the original IP address. If present, then its value should be used with care, as one can easily add a fake header and make it refer to some innocent person.

Most log files do not show that HTTP header, so you'll need to do some scripting of your own to ensure these headers are logged, if you want them.

1

If it is your blog site, you can add SiteMeter to it. It won't tell you about the one you are looking for right now, but it will from here on out. It will also tell you where they entered your site from, and where their location is.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .