5

Some websites like http://www.geoip.co.uk are able to get the private IP address of my host where as others like https://www.iplocation.net/ are unable to do so.
What is the reason behind this behaviour? I always thought that private IP is inaccessible to servers if I am using a NAT interface.
Does NAT append the public IP to the outgoing packet or it removes the private IP completely? If the latter is the case, why is the above mentioned behaviour observed?
Also, when I viewed the source code of http://www.geoip.co.uk, I observed that my IP is rendered directly as text, i.e. without any sort of call to a JavaScript function. So how does the website know my private IP before it even renders the web page?

privateip

The 10.9.64.58 is my private IP address (the one I get after ipconfig).

EDIT : As @simlev points out that I should add the following information: I am a university student and am connected to institute's LAN when visiting the site on my PC but I observe the same behaviour on my phone too and my phone isn't on that LAN. Imgur screenshots here and here.

EDIT: Another observation which I feel is relevant : When I visit the website using https:// I get my public IP (the desired thing) but only when I visit it using http:// I get the private IP. So, is there some protocol issue we are talking about here?

  • 1
    What's the format of the IP being displayed? With NAT you IP doesn't leave the network. – Seth Mar 16 '17 at 14:16
  • 1
    It shouldn't be able to see your private IP, and it can't see mine. What browser/OS are you using to access the site that is showing it to you? – Ƭᴇcʜιᴇ007 Mar 16 '17 at 14:16
  • @techie007 - Chrome on Windows 10. Is it okay if I add a screenshot? Is it okay if other people get to know my private IP? I mean, any security issues I could get into? – Shraddheya Shendre Mar 16 '17 at 14:22
  • Since you are talking about web pages, your browser is about the only thing that could add this information to the packet, so it could be an extension/plugin. You are correct, NAT replaces the source address in the IP header, but it is possible that the IP address is being placed in other areas of the data region of the Layer3 packet. As for how the server knows the IP and puts it in a page, a modern webserver is an application service that renders HTML dynamically, based on a request. An HTTP Request has a clear source IP address so the server knows it before rendering the response HTML, – Frank Thomas Mar 16 '17 at 14:22
  • 1
    I don't think it's ajax: I could reproduce this even with javascript off. – simlev Mar 16 '17 at 15:10
5

Do you use a http proxy? In my case the web proxy forwards the internal ip, it's probably an anti-abuse feature.

A similar possibility is that your ISP only gives you a shared external ip address and then when you visit websites it also passes them your internal ip; this is in order to identify abusers: the website can provide both ips when filing an abuse report with the ISP and thanks to the internal ip the ISP is able to quickly trace the abusive user. It would be harder to do this having only the external, shared ip.

Since both the internal and external ips are passed with your request, some of the show-your-ip websites choose to show the ip the request actually comes from, while some others show the ip on whose account the request was made.

Check the headers you are sending (e.g. here). You probably have a X-Forwarded-For with your private ip added by either something on your network or one of the ISP's network devices.

For further information, see Cristopher's, Adam Katz's and Mark's answers here. By the way, Mark provides the same suggestion as I do and links to the same website :-)

Update: yes, you are (very likely) using a proxy.

If you are on campus, as might be inferred from your comment, it only makes sense that your ISP (aka the university) does not connect each one of its students directly to the Internet: I'm prone to speculate that you are transparently proxied.

Update: As the OP noticed and correctly pointed out, the same website visited over https shows the external ip instead. This is expected, since proxies usually do not alter https traffic and therefore cannot add the X-Forwarded-For that gives away the internal ip address.

  • No, I don't use a proxy server. – Shraddheya Shendre Mar 16 '17 at 14:58
  • Can you please share a bit more insight on your home network and ISP network? Do you get your own ip or a shared one? Static or dynamic? – simlev Mar 16 '17 at 15:09
  • Downvoters are encouraged to also comment with any constructive criticism. – simlev Mar 16 '17 at 15:35
  • I am an university student, I do not know my ISP. But I "Obtain my IP settings automatically" on Windows after connecting to Ethernet. DHCP is enabled and I guess that means that my IP is dynamically assigned. And I get my own private IP. – Shraddheya Shendre Mar 16 '17 at 18:34
  • @ShraddheyaShendre This is a valuable piece of information that you should add to your question. I updated the answer accordingly. – simlev Mar 16 '17 at 19:47
2

It is possible that the website is taking advantage of the WebRTC security leak.

uBlock Origin (for Firefox / for Chrome) is capable of closing this security vulnerability. But you must go to its Settings page and check the appropriate box called "Prevent WebRTC from leaking local IP addresses".

  • But as I said, the issue is getting reproduced even for Internet Explorer and my phone's browser. – Shraddheya Shendre Mar 16 '17 at 18:35
  • @ShraddheyaShendre I thought WebRTC was added to IE, but it seems I was wrong. Wikipedia says it hasn't. – user477799 Mar 16 '17 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.