网络虽然是虚拟世界,但它是建立在物质基础之上的,因而只要信息在网上传输, 就必然会在传输设备上留下“痕迹”,只不过留下的“痕迹”比现实世界留下的痕迹更加隐蔽,难以发现和提取。众所周知,在网上每台计算机都有自己唯一的地址,就如城市中每一栋房子都有一个门牌号一样,这个地址就是我们常说的“IP地址”。信息在互联网上传输是利用 TCP/IP完成的。在TCP/IP互联网上传输的一个分组信息叫IP数据包,每个数据包包含一个头部和位于其后的数据。在数据包头部有发送信息的源地址和目的地址,这些地址采用的是IP地址。根据这一原理,只要上网传送信息,就必然在IP数据包中留下发送信息设备的IP地址,该IP地址就是在网上传送信息时留下的信息源“痕迹”。在网上通信时,只要能够提取到信息源“痕迹”,侦查人员就可以通过互联网上这独一无二的 IP地址,查获发送信息的计算机,从而结合传统的侦查方法确定犯罪嫌疑人。 Although the network is a virtual world, it is based on the material basis, so as long as the information is transmitted on the Internet, it is bound to leave “traces” on the transmission equipment, leaving only “traces” behind the real world More hidden traces of hard to find and extract. As we all know, each computer on the Internet has its own unique address, just as every house in a city has a house number. This address is what we commonly refer to as an “IP address.” The transmission of information over the Internet is done using TCP / IP. A packet of information transmitted over the TCP / IP Internet is called an IP packet. Each packet contains a header and the data that follows it. In the header of the data packet to send information source address and destination address, these addresses use the IP address. According to this principle, as long as the Internet transmits information, it is inevitable that the IP data packet leaves the IP address of the sending information device, which is a “trace” of the information source left when the information is transmitted over the Internet. When online communication, as long as the source can be extracted from the “traces”, investigators can use this unique IP address on the Internet, seized the computer to send information, combined with the traditional detection methods to determine the suspects.