So this question has more to do with what useful packet information can be picked up by an IDS sensor (for example) based on its placement on an internal network. Suppose we have a sensor placed at a core switch, and the payload of an inbound packet from an external source contains some activity of interest.

Would the Source IP reflect the external host which sent the traffic, or would that information be stripped and replaced with the IP of an intermediary network device which routed the traffic? Is there a common circumstance in which sensor placement would mean constantly seeing an internal IP as the source rather than the external host?

1 Answer 1


Most commonly, the source IP of a packet from an external source will be unchanged. It is possible that your border router or firewall could translate that address to an internal (i.e., private) address, but that is uncommon. Your firewall administrator can tell you if that is the (unlikely) case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.