From d55c0de40850864824a311e4ba0f07387959dc5a Mon Sep 17 00:00:00 2001 From: Tomislav Novak Date: Thu, 27 Aug 2026 14:56:19 +0100 Subject: [PATCH] [LOGPUSH] Update Gateway Network SourceInternalIP wording MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updating the SourceInternalIP field description because the current wording says it is only available for GRE/IPsec tunnel on-ramps and represents the local LAN IP. A customer confirmed this is also populated for WARP client (device_client) traffic, where the value represents the WARP CGNAT/internal address rather than the device’s local LAN IP. This change clarifies the field behavior across on-ramp types and avoids customers assuming the field should be empty for WARP traffic. --- .../logpush/logpush-job/datasets/account/gateway_network.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md index a2b617a3ee5..12104038c66 100644 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md +++ b/src/content/docs/logs/logpush/logpush-job/datasets/account/gateway_network.md @@ -169,7 +169,7 @@ Country code of the source IP of the network session (for example, 'US'). Type: `string` -Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp. +Internal IP of the device. For WARP client traffic, this is the WARP CGNAT address, typically in the `100.96.0.0/12` range. For GRE/IPsec tunnel [on-ramps](/cloudflare-one/networks/connectivity-options/), this may represent the local/private source IP behind the tunnel. ## SourcePort