Are IP Addresses and CGNAT Records Evidence? Ports, Timestamps, NAT Logs and Court of Cassation Decisions

Last updated: 15.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

What Is an IP Address?

An IP address is an identification number, consisting of a series of numbers and dots, assigned to every device that connects to the internet. Just as land, sea or air vehicles must obtain a registration plate in order to go out into traffic, the IP address is likewise a kind of registration plate used by each user when going out into internet traffic.

Technically, IP is a connectionless datagram protocol responsible for the addressing and routing of packets between computers. Networks decide to which network a packet is to be routed by looking at the IP address portion of the data packets they receive. IPv4 addresses are written as four sets of numbers, each consisting of a number between 0 and 255, that is, in the format xxx.xxx.xxx.xxx. The moment a user enters any application or search engine, an IP number is assigned to the device through which access is made. The definition in the legislation is as follows:

Does Every IP Address Belong to a Single User?

No; this is precisely where the registration plate analogy reaches its limit. The total number of IPv4 addresses in the world is 2³², that is, approximately 4 billion. Since the number of IPv4 addresses allocated to Türkiye is far below the number of subscribers, operators are compelled to share addresses among a large number of subscribers; for example, in an operator with 20 million subscribers, there is approximately 1 IP address for every 12 users. Because of this shortage, IP addresses are divided into three groups:

• Static IP: A fixed address assigned by the access provider to the subscriber and exclusive to that user alone. If the IP address has been statically allocated, via a fixed line, to a real address and person, the investigation proceeds more easily; where necessary, a search of the home and of the information technology devices can establish more clearly whether the transaction was carried out over that line.
• Dynamic IP: A non-personal and temporary address that the access provider makes available for the common use of all subscribers and that is randomly assigned upon connecting to the internet. With a dynamic IP, the subscriber can be identified only with complete time information.
• NAT IP: A translation method that enables a large number of devices to access the internet from behind a single public IP address. The real dispute in criminal case files arises with this type and with CGNAT, its large-scale form.

Why Did IPv4 Become Insufficient, and Does IPv6 Solve the Problem?

The greatest shortcoming of IPv4 is that its address capacity is limited to 32 bits; as internet use became widespread, this capacity proved insufficient in the face of the growing number of devices and users. In the IPv6 protocol, by contrast, capacity has been increased considerably through the use of 128-bit addresses.

Türkiye took the first step towards this transition with the Prime Ministry Circular (Başbakanlık Genelgesi) published in the Official Gazette dated 08.12.2010 and numbered 27779. However, since IPv4 and IPv6 are not compatible with each other, a complete transition requires a long timetable. Until the transition is completed, efforts are being made to render the existing IPv4 addresses sufficient by means of NAT technology, and this is also the source of the problems in identifying the perpetrator.

What Is NAT and How Does It Work?

NAT (Network Address Translation) is the protocol that enables a device’s original IP address to be replaced with another address when the device goes outside its own network, for example to the internet. The following address ranges have been reserved as private IP addresses for use in local networks:

• 10.0.0.0/8 → 10.0.0.0 – 10.255.255.255
• 172.16.0.0/12 → 172.16.0.0 – 172.31.255.255
• 192.168.0.0/16 → 192.168.0.0 – 192.168.255.255

For example, when a computer at home with the address 192.168.1.34 wants to connect to a website, the NAT router (modem) receives the packet, replaces the source address with its own public IP and forwards it to the destination. The other side sees only the public IP address; the device’s private IP never leaves the local network. The router keeps, in the NAT records, a record of which private IP has been translated to which public IP over which port.

From the investigative perspective, the problem is that NAT performs the function of hiding the private network behind a public gateway. Large institutions with thousands or even hundreds of thousands of machines may be represented on the internet by only a few hundred IP addresses. Because private IPs are continuously converted into public addresses, the same public IP may be allocated to more than one user within the same second. For this reason, in IP identification, reaching the perpetrator becomes impossible without complete time information covering the date, hour, minute and second.

What Is CGNAT and How Does It Differ from Standard NAT?

CGNAT (Carrier Grade NAT, NAT444) is a type of NAT, using an additional translation layer, by which the internet service provider (ISP) shares its limited number of public IPv4 addresses among a large number of subscribers. While standard NAT translates a private IPv4 address into a public IPv4 address, CGNAT first processes subscriber traffic over the ISP’s own private IPv4 network. Thus, viewed from the outside, thousands of different subscribers appear to be using the same IP address.

To make CGNAT concrete, the telephone switchboard analogy is apt. As in a building with a switchboard, CGNAT relies on a certain number of public IP addresses (the building’s telephone numbers) and the private IP addresses beneath them (the internal extensions). When a device wishing to call outside comes along, the system allocates it a public IP; once the operation is over, this address is released and assigned to another device. Just as finding the caller in a call made from the building to the outside requires a system that keeps internal call records and an accurate determination of the time of the call, CGNAT likewise requires a match to be established between the external (public) IP and the internal (private) IP.

This situation is called “address sharing at ISP level”. Since the shared IP address loses its quality of “uniqueness”, it also becomes more difficult for the ISP to classify traffic data correctly and give non-misleading answers to the judicial authorities.

Is an IP Address Evidence on Its Own?

No; an IP address shows only through which internet access the connection was made, not the person who made the connection. In offences committed over the internet, the IP address is the first data to which the investigating authorities turn, and the subscription to which the address belongs can be learned from the ISP. The most common error in practice, however, is accepting that the IP address directly identifies the perpetrator.

Family members using the same connection, employees at a workplace, users in a café or persons connecting to a guest network access the internet with the same public IP address. In accordance with the requirement, which is a fundamental principle of criminal procedure, that the material truth be established free from any doubt, electronic evidence must also be assessed together with mutually corroborating technical data. An IP address that is not supported by port information, timestamps, NAT records, modem logs, device examination and, where necessary, an expert report does not constitute conclusive evidence.

Why Must Port Information, Timestamps and NAT Logs Be Assessed Together?

Because, in a CGNAT infrastructure, the right person among thousands of subscribers using the same IP can be reached only by matching the triad of IP address + source port number + timestamp with the NAT log records. The ISP allocates a specific port number to each connection and stores this mapping, with its date and time, in the NAT logs. Therefore, a mere finding in the file to the effect that “IP address 185.xxx.xxx.xxx was used on the date of the offence” is not sufficient to identify the actual user. The investigating authority must request at least the following data from the ISP:

Once this triad is matched, the subscriber to whom the connection was allocated can, technically, be determined to a large extent; the subscription information thus obtained must then be supported by a digital forensic examination to be carried out on the digital materials. The IP address is merely the starting point of the technical examination.

How Does the Court of Cassation Approach IP Addresses and CGNAT Records?

The Court of Cassation does not consider the mere identification of an IP address or a CGNAT record sufficient for a conviction; it requires the technical inquiries that will lead to the actual user who made the connection to be carried out in full. Three decisions clearly illustrate this approach.

1. Criminal General Assembly: A CGNAT Record Is “Metadata” and an Indication (Emare)

The CGNAT (HIS) records, on the other hand, which are kept by the operators and contain the internet traffic records relating to the connections of subscribers who connected from Turkish IPs to the 9 IP addresses belonging to the ByLock server, are a kind of metadata. Since these data establish that the subscriber’s IP address connected to the IP addresses belonging to the ByLock server, they constitute a significant indication that the person may have joined the ByLock system; however, beyond the connection to the IP addresses, they contain no information as to whether a User-ID number was assigned to the relevant subscriber for joining the system and, if so, what that number is.
— Criminal General Assembly of the Court of Cassation, E. 2018/420, K. 2019/230, 19.03.2019

Significance of the decision: A CGNAT record shows that a subscriber connected to a particular IP address; it does not show what was done beyond that connection. It is therefore not conclusive evidence on its own but, in identifying the perpetrator, indicative evidence (emare).

2. Decision of the 2nd Criminal Chamber of the Court of Cassation Dated 11.12.2018

The Chamber held it mandatory to investigate whether third parties could access the internet via the IP address used by the defendant, whether the internet line was open to outside access and whether it was possible for others to gain access by cracking the password via the internet, to identify the computers from which the connection was made and, where multiple IP use is in question, to obtain the PORT and MAC address information from the relevant internet service provider.
— Court of Cassation, 2nd Criminal Chamber, E. 2016/14786, K. 2018/15164, 11.12.2018

Significance of the decision: The Court of Cassation did not consider it sufficient to render a judgment based solely on the subscription record and required the technical examination to be deepened by means of an expert.

3. Decision Dated 12.12.2019 Concerning the Unauthorised Purchase of Prepaid Credit (Kontör) with a Credit Card

It was held that the investigation had been conducted inadequately, since the users, on the date of the offence, of the IP addresses through which the prepaid credit sales transactions were carried out had not been identified, it had not been investigated to whom the e-mail address used when creating the membership belonged, and the transaction records had not been obtained in full.
— Court of Cassation, 8th Criminal Chamber, E. 2019/12225, K. 2019/14972, 12.12.2019

Significance of the decision: The Court of Cassation required e-mail information, membership records and transaction logs to be assessed together with the IP records, that is, the digital chain of evidence to be completed by establishing a correlation between the items of electronic evidence. For the general framework of such cases, see our article on fraud through the use of information systems as an instrument.

Why Should a CGNAT Record Be Treated Like “a Shoe Print in the Mud”?

Because a CGNAT record points not to a person but only to a possibility. We consider it appropriate that the Criminal General Assembly does not regard these records as conclusive evidence on their own. However, whereas, given the nature of CGNAT technology, these records should be accepted only as “indicative evidence” and treated like “a shoe print in the mud”, positioning them as a “significant indication” to a degree capable of forming the basis of a conviction may lead to violations of rights.

Let us make the example concrete: in a scenario in which only a shoe print in the mud is taken as the basis of the judgment, everyone who owns that shoe model would have to be included in the judicial inquiry as a suspect. This leads both to the inefficient use of law enforcement’s working time and energy and to innocent individuals being unjustly subjected to judicial proceedings. For this reason, CGNAT records must not be made the sole basis of a conviction without being supported by source port and timestamp matching, device examination and other concrete evidence.

What Happens If the CGNAT Record and Port Information Are Not in the File?

If there is no port information, the subscribers using the same public IP cannot be distinguished from one another, and the identification of the subscriber in the file cannot take the place of the identification of the perpetrator. The investigating authority may have an IP address in hand; however, the actual user who established a connection from that address may not yet have been identified. From the defence perspective, the critical distinction is this: Identifying the internet subscription is not the same as identifying the perpetrator of the offence.

Therefore, the first question for the defence should not be “To whom does this IP address belong?” but “Is this technical data sufficient to single out the actual user?”. The IP identification report in the file and the ISP’s reply letter must be examined, and it must be investigated whether the identification is based solely on the IP and date-time information, whether the source port is available and with what precision the time information was recorded. Treating a subscriber identification made without these three items of data being properly matched as an identification of the perpetrator is a serious technical and legal error.

Is There a Digital Trace Between the IP Address and the Suspect’s Device?

At the second stage of the defence, it must be investigated whether a technical link can be established between the IP address and the device used by the suspect. In the digital forensic examination of the suspect’s computer or mobile phone, has a log record, browser data, session information, application residue or any other digital trace been found relating to the website, system or user account that is the subject of the offence?

If the answer is no, the following question remains unanswered: By what technical evidence is it established that the transaction that is the subject of the offence was carried out by the suspect? In shared home or workplace internet connections, on wireless networks and in CGNAT infrastructure, the fact that the subscription is registered in the suspect’s name does not in every case identify the actual user. A similar subscriber–user distinction also applies to mobile lines; we examined this in our article on HTS records.

What Should the Defence Investigate in Cases Based on an IP Address?

The aim of the defence is not merely to challenge the IP address but, with regard to the chain of technical evidence leading from the IP address to the actual user, to verify whether that chain has been fully established. To this end, answers to the following questions must be sought:

• Has the source port number been identified?
• With what precision (to the second?) were the date and time of the connection recorded?
• Have the IP, port and timestamp been matched together?
• Have the ISP’s raw logs or CGNAT records been examined?
• Is the line open to outside access, can the wireless network password be cracked by third parties, and could the connection have been used by other persons?
• Has any digital trace relating to the act that is the subject of the offence been found on the suspect’s devices?

Reaching a conclusion as to the perpetrator directly from the IP address without these questions being answered amounts to converting a technical connection datum into evidence of a person. For the general workings of the investigation phase and the lawyer’s role at that stage, see our article on the cybercrime investigation process.

As Coşkun Genç Law Office, we conduct the defence in Istanbul in IP- and CGNAT-record-based cybercrime cases; for an assessment of your specific case, you can contact us.