Is External Source IP info routinely stripped/replaced as it traverses through internal network?

Question

So this question has more to do with what useful packet information can be picked up by an IDS sensor (for example) based on its placement on an internal network. Suppose we have a sensor placed at a core switch, and the payload of an inbound packet from an external source contains some activity of interest.

Would the Source IP reflect the external host which sent the traffic, or would that information be stripped and replaced with the IP of an intermediary network device which routed the traffic? Is there a common circumstance in which sensor placement would mean constantly seeing an internal IP as the source rather than the external host?

Answer 1

Most commonly, the source IP of a packet from an external source will be unchanged. It is possible that your border router or firewall could translate that address to an internal (i.e., private) address, but that is uncommon. Your firewall administrator can tell you if that is the (unlikely) case.