After investigating I finally found solution from packets captured by Wireshark:User-Agent: Mozilla/5.0 (ABE, http://noscript.net/abe/wan)
NoScript feature called ABE uses public address of routers.
Question
To log IP addresses of people visiting my web site I used $_SERVER['REMOTE_ADDR']
.
192.168.111.111 18.04.2014 23:25:23
<- My local computer
54.72.x.x 19.04.2014 10:05:53
<- Actual remote visitor, so this is working
84.251.x.x 19.04.2014 12:41:38
<- ?
84.251.x.x
is public address of my router. I cannot understand why that IP would have visited my website.
So why would $_SERVER['REMOTE_ADDR']
log this address? Documentation says it should show IP of user viewing page and as far as I understand router would not do such a thing.
My network consist of computer, web server (Raspberry Pi) and ZyXEL P-660HN-T1A router.
EDIT: I didn't do anything at 12:41 so that visit was not caused by me.
EDIT2: First I though this might have been problem with PHP $_SERVER['REMOTE_ADDR']
but I just managed to capture same event with Wireshark. It also shows HTTP query coming from 84.251.x.x
. I just can't understand why this happens.
Solution
After investigating I finally found solution from packets captured by Wireshark:User-Agent: Mozilla/5.0 (ABE, http://noscript.net/abe/wan)
NoScript feature called ABE uses public address of routers.