Digging for an IP Address

Apps that request things from your website have an IP address. The IP address tells the website where to respond to.

The requesting app generally is a browser. It may be a robot or spider. It might be a VPN website app. Whatever it is, the app asks for something from your website.

When asked for something by a browser or other app, it is typically either a request for a response from PHP or other software on your website or a request for a web page available at your site. Additional requests may be made (images, CSS files, videos, …) to complete the construction of a web page.

All of that, everything, requires an IP address to send stuff to. The app tells your website the IP address to use, and your website sends its response to that IP address.

When an app tells your website what IP address to send stuff to, the IP address is contained in the REMOTE_ADDR value. In PHP, you access that value with the $_SERVER['REMOTE_ADDR'] variable.

So why, if the IP address is clearly available, would a person want to dig?

Because the REMOTE_ADDR address used to send stuff to might not be the IP address of your stuff's actual destination.

If the app requesting content from your website is via a VPN app or a relay, then your stuff is likely sent somewhere else after it arrives at the REMOTE_ADDR address.

The REMOTE_ADDR address is all that's needed for your website to respond to requests.

But if you require the actual destination, the PHP function below can be inserted into your PHP web page or software. GetTheRealIPaddress() tries to get the actual destination IP address. The function won't always succeed because the information is not always available.

The actual destination might be used by statistics logs (for reporting user counts by country, as an example), to determine the user's time zone, or even to block if the IP address is on a "bad" list. Or just because you are curious.

Here is a demonstration. It should display your IP address. If you use a relay or VPN, it might display the final destination IP (depending on whether the information is available).

The IP address is 216.73.216.53

And here is the PHP function itself, along with a couple lines of code used for the above demonstration.

<?php
$IP = GetTheRealIPaddress();
echo("<p style='background-color:yellow; width:fit-content; padding:.5em;'>The IP address is <b>$IP</b></p>");

/* Dig for IP Address Function */
function GetTheRealIPaddress()
{
   foreach( array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key )
   {
      if(array_key_exists($key,$_SERVER))
      {
         foreach( explode(',',$_SERVER[$key]) as $ip )
         {
            if(filter_var($ip,FILTER_VALIDATE_IP)) { return $ip; }
         }
      }
   }
} # function GetTheRealIPaddress()
/* End of Dig for IP Address Function */
?>

The GetTheRealIPaddress() function checks other server variables that might contain a real destination IP address. If it finds one, it returns the IP address. The REMOTE_ADDR server variable is checked last. Therefore, there will always be an IP address for the function to return.

(This content first appeared in Possibilities newsletter.)

Will Bontrager