From 879c9b00fc5a4c6635a44156fa2a69c2f4af8c7b Mon Sep 17 00:00:00 2001 From: Tomislav Novak Date: Thu, 27 Aug 2026 15:31:48 +0100 Subject: [PATCH] [LOGPUSH] Update Gateway HTTP SourceInternalIP wording MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updating the SourceInternalIP field description because the current wording says it is only available for GRE/IPsec tunnel on-ramps and represents the local LAN IP. A customer confirmed this is also populated for WARP client (device_client) traffic, where the value represents the WARP CGNAT/internal address rather than the device’s local LAN IP. This change clarifies the field behavior across on-ramp types and avoids customers assuming the field should be empty for WARP traffic. Fix per merge for Fix Gateway analytics IPv4 byte order --- .../logs/logpush/logpush-job/datasets/account/gateway_http.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md index aa44f9e100b..29c7bc9d975 100644 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md +++ b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_http.md @@ -295,7 +295,7 @@ Country code of the source IP of the request (for example, 'US'). Type: `string` -Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp. +Internal IP of the device. For WARP client traffic, this is the WARP CGNAT address, typically in the `100.96.0.0/12` range. For GRE/IPsec tunnel [on-ramps](/cloudflare-one/networks/connectivity-options/), this may represent the local/private source IP behind the tunnel. ## SourcePort