When reviewing Windows event logs for Jump Desktop Connect, most incoming connection entries have public IP addresses as expected but some have private IP addresses that don't match the LAN they're on.
The ones I have seen are RDP connections using the private IP 172.31.x.x.
Example entry: Incomming Connection: Type:Cloud, ConnectionID:xxx, TunnelID:rdp, PeerID:xxxx, Email:xxxx, IP:172.31.32.230.
Thanks to someone who can explain what causes these private IP addresses to be logged rather that the users's public IP address.
Please sign in to leave a comment.