If you are a Direct Access administrator you may need to locate a client’s real IP address, the one given to them by the ISP. This is known as the “ISP Address” but due to how Direct Access works this is blank.
The ISP address field is blank for clients using the IP-HTTPS IPv6 transition protocol. ISP Address information is only displayed for clients using the 6to4 or Teredo IPv6 transition protocols.
Where to locate the “ISP Address”
The real client IP address can be found in the Iphlpsvc log.
Open “Event Viewer”
Open “Applications and Services Logs” then expand “Microsoft” then “Windows”
Open “Iphlpsvc” and click on “Operational”
Look for “Event ID” number 4303 this will show real ISP Address ( as per image below )