internal or external IP

pma111
pma111 used Ask the Experts™
on
What would be an easy way to determine if the source IP in some IIS logs on an exchange cas server is that of an internal ip address ie desktop computer of user connected to our private network or an external ip ie personal smartphone or pc when remotely accessing their mail via active sync on their own phone outlook anywhere or owa etc
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
External IP addresses can be searched to determine who owns it.
https://www.arin.net/

Search top right "who is"

If the source IP address is that of your internal network range - it is originating from the inside.
2015-04-19-1225.png
If you use RDS or citrix it would be those "access" logs.

Is there more to your question?
and if you search for a private/internal address at arin.net,  arin will show you that it's "private" (Name      PRIVATE-ADDRESS-BBLK-RFC1918-IANA-RESERVED"

So either way, search at arin.net and it'll tell you.
Gerwin Jansen, EE MVETopic Advisor
Most Valuable Expert 2016
Commented:
Filter out all addresses from the internal IP range(s), what remains is the list you want.

Your IIS log files are on the windows platform so you can use 'findstr' on a command line to filter, like this:

findstr /i /v "<ip pattern>" *.log

For example:

findstr /i /v "10.0.1" *.log

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial