title: Log shows two different IP addresses for user
body: <p>This question might be more appropriate for a different Stack Exchange board and I am willing to migrate it there if that is the case.</p>
  
  <p>In a web application I've worked on, we log some event info in order to help troubleshoot problems that may arise. One of the things we log is the user's IP address. While looking into an issue, I noticed the associated user seemingly has two different IP addresses for certain events. Using an IP address look up, the physical locations are relatively close&mdash;the user might be using a remote connection to an office or something. I don't know if that information is useful at all.</p>
  
  <p>The application logs events from PHP and from Javascript via AJAX requests. At first I thought the different IP addresses were a result of events being initiated by either PHP or AJAX. However, there are two instances of the same AJAX initiated event logged with both IP address. Both instances of this event occurred roughly 30 minutes apart. The resulting logs look a bit like this:</p>
  
  <pre><code>|        Date        |      Action          |    IP Address   |
  |-------------------------------------------------------------|
  |2016-07-15 12:59:59 | AJAX Initiated Event | 123.123.123.123 |
  |-------------------------------------------------------------|
  |2016-07-15 13:30:00 | AJAX Initiated Event | 111.111.111.111 |
  |-------------------------------------------------------------|         
  |2016-07-15 13:45:00 | PHP Initiated Event  | 123.123.123.123 |
  |-------------------------------------------------------------|
  |2016-07-15 13:45:01 | AJAX Initiated Event | 111.111.111.111 |
  |-------------------------------------------------------------|
  |2016-07-15 13:45:09 | PHP Initiated Event  | 123.123.123.123 |
  </code></pre>
  
  <p>I'm grabbing the user's IP address with PHP's <code>$_SERVER['REMOTE_ADDR']</code>.</p>
  
  <p>Any thoughts as to why two different IP addresses might be logged? Could it be due to something like a remote connection?</p>