How do special services calculate a person by IP if he is sitting behind a NAT provider?

Question

Computer networks

Suppose a certain citizen has committed an illegal act on the network (for example, he offered to buy drugs or weapons from him from a fake VK page). His IP address is found out by special services. But in the end it turns out that this IP was not assigned to a specific client of the provider. Under this external IP address, at such and such a time, there were about 100 clients behind the provider's NAT. How will they calculate from these 100 people who exactly sat under this fake VK page?

Answer 1

EMNIP providers were required to keep logs of NAT broadcasts, you can use them to find the internal IP, use it (with a timestamp) - the port and the contract, then you can arrange mask shows.

Answer 2

https://ru.wikipedia.org/wiki/%D0%97%D0%B0%D0%BA%D...

Answer 3

the provider stores traffic to nat, that is, he knows which client was contacting at a given time in a given place

Answer 4

Но в итоге оказывается, что данный IP не назначался определенному клиенту провайдера. Под данным внешним IP-адресом в такое-то время сидело около 100 клиентов за NAT провайдера. Как будут вычислять из этих 100 человек, кто же именно сидел под данной фейковой страницей ВК?

What do you mean not appointed. OF COURSE appointed, just not fixed for a long time. But the provider naturally has logs.
If nothing zakrpelyaetsya, how would the provider give you bills?
Special services will not even calculate anything. They will come with a warrant to the provider, and he will give them everything and even more.

Answer 5

The special services will recognize the provider by white ip (because Department K has lists of subnets) and simply send him a letter with the text "either answer yourself or give out data", and of course the provider will show all the logs, even before, even after nat, dhcp . vlan. mac and so on. in order to remove responsibility as much as possible and shift it to the client.
Further proceedings are the problems of the client

Answer 6

Elementary Watson!
By IP, you can see, let's say that this is Vkontaktik. They send a request to VKontaktik - who connected in such and such a time interval and did this and that? What do you think VKontaktik will answer? Yes, of course, he will give all the necessary logs :)
Then they will turn to the provider - and he will also give all the necessary logs, address, phone number - and that's it, the guests will come. It is better to open the door yourself, otherwise they will enter without paying attention to it :)

Answer 7

For providers with TSPU installed, the installation occurs before NAT.