Move network.client.ip out of AppSec into HttpServerDecorator

smola · smola · commit 4e0646d94a97 · 2026-04-27T18:17:33.000+02:00
network.client.ip now shares the same activation logic as http.client_ip
(DD_APPSEC_ENABLED or DD_TRACE_CLIENT_IP_ENABLED) and is no longer
exclusive to AppSec events. Move it from GatewayBridge (where it was
set only when security events fired) into HttpServerDecorator alongside
http.client_ip, using the raw peer/socket IP.

actor.ip remains in AppSec as a deprecated backward-compatibility tag.
diff --git a/dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/decorator/HttpServerDecorator.java b/dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/decorator/HttpServerDecorator.java
@@ -370,6 +370,9 @@ public AgentSpan onRequest(
       } else {
         span.setTag(Tags.PEER_HOST_IPV4, peerIp);
       }
+      if (clientIpResolverEnabled) {
+        span.setTag(Tags.NETWORK_CLIENT_IP, peerIp);
+      }
     }
     setPeerPort(span, peerPort);
     Flow<Void> flow = callIGCallbackAddressAndPort(span, peerIp, peerPort, inferredAddressStr);
diff --git a/dd-java-agent/agent-bootstrap/src/test/groovy/datadog/trace/bootstrap/instrumentation/decorator/HttpServerDecoratorTest.groovy b/dd-java-agent/agent-bootstrap/src/test/groovy/datadog/trace/bootstrap/instrumentation/decorator/HttpServerDecoratorTest.groovy
@@ -218,6 +218,7 @@ class HttpServerDecoratorTest extends ServerDecoratorTest {
     1 * this.span.setTag(Tags.HTTP_FORWARDED_HOST, "somehost")
     if (conn?.peerIp) {
       1 * this.span.setTag(ipv4 ? Tags.PEER_HOST_IPV4 : Tags.PEER_HOST_IPV6, conn.peerIp)
+      1 * this.span.setTag(Tags.NETWORK_CLIENT_IP, conn.peerIp)
     }
     if (conn?.ip) {
       1 * this.span.setTag(Tags.HTTP_CLIENT_IP, conn.ip)
@@ -253,6 +254,7 @@ class HttpServerDecoratorTest extends ServerDecoratorTest {
 
     then:
     1 * this.span.setTag(Tags.HTTP_CLIENT_IP, result)
+    1 * this.span.setTag(Tags.NETWORK_CLIENT_IP, peerIpAddr)
 
     where:
     headerIpAddr | peerIpAddr  | result
@@ -277,6 +279,7 @@ class HttpServerDecoratorTest extends ServerDecoratorTest {
     0 * extracted.getForwarded()
     0 * span.setTag(Tags.HTTP_FORWARDED, _)
     0 * this.span.setTag(Tags.HTTP_CLIENT_IP, _)
+    0 * this.span.setTag(Tags.NETWORK_CLIENT_IP, _)
   }
 
   void 'disabling appsec disables header collection and ip address resolution'() {
@@ -294,6 +297,7 @@ class HttpServerDecoratorTest extends ServerDecoratorTest {
     0 * extracted.getForwarded()
     0 * span.setTag(Tags.HTTP_FORWARDED, _)
     0 * this.span.setTag(Tags.HTTP_CLIENT_IP, _)
+    0 * this.span.setTag(Tags.NETWORK_CLIENT_IP, _)
   }
 
   void 'disabling appsec but enabling client_ip_without_appsec enables header collection and ip address resolution'() {
@@ -313,6 +317,7 @@ class HttpServerDecoratorTest extends ServerDecoratorTest {
     2 * extracted.getXForwardedFor() >> '2.3.4.5'
     1 * this.span.setTag(Tags.HTTP_CLIENT_IP, '2.3.4.5')
     1 * this.span.setTag(Tags.HTTP_FORWARDED_IP, '2.3.4.5')
+    1 * this.span.setTag(Tags.NETWORK_CLIENT_IP, '4.4.4.4')
 
     // Forwarded doesn't participate in client ip resolution anymore
     1 * extracted.getForwarded() >> 'for=9.9.9.9'
@@ -333,6 +338,7 @@ class HttpServerDecoratorTest extends ServerDecoratorTest {
     then:
     1 * extracted.getCustomIpHeader() >> '5.5.5.5'
     1 * this.span.setTag(Tags.HTTP_CLIENT_IP, '5.5.5.5')
+    1 * this.span.setTag(Tags.NETWORK_CLIENT_IP, '4.4.4.4')
   }
 
   def "test onResponse"() {
diff --git a/dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java b/dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java
@@ -986,9 +986,6 @@ private NoopFlow onRequestEnded(RequestContext ctx_, IGSpanInfo spanInfo) {
 
         span.setTag("appsec.event", true);
 
-        String peerAddress = ctx.getPeerAddress();
-        span.setTag("network.client.ip", peerAddress);
-
         // Reflect client_ip as actor.ip for backward compatibility
         Object clientIp = tags.get(Tags.HTTP_CLIENT_IP);
         if (clientIp != null) {
diff --git a/dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/gateway/GatewayBridgeSpecification.groovy b/dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/gateway/GatewayBridgeSpecification.groovy
@@ -189,12 +189,10 @@ class GatewayBridgeSpecification extends DDSpecification {
     then:
     1 * spanInfo.getTags() >> TagMap.fromMap(['http.client_ip': '1.1.1.1'])
     1 * mockAppSecCtx.transferCollectedEvents() >> [event]
-    1 * mockAppSecCtx.peerAddress >> '2001::1'
     1 * mockAppSecCtx.close()
     1 * spanInfo.setMetric("_dd.appsec.enabled", 1)
     1 * spanInfo.setTag("_dd.runtime_family", "jvm")
     1 * spanInfo.setTag('appsec.event', true)
-    1 * spanInfo.setTag('network.client.ip', '2001::1')
     1 * spanInfo.setTag('actor.ip', '1.1.1.1')
     1 * traceSegment.setDataTop('appsec', new AppSecEventWrapper([event]))
     1 * mockAppSecCtx.isWafBlocked()
diff --git a/dd-java-agent/instrumentation-testing/src/main/groovy/datadog/trace/agent/test/base/HttpServerTest.groovy b/dd-java-agent/instrumentation-testing/src/main/groovy/datadog/trace/agent/test/base/HttpServerTest.groovy
@@ -2497,16 +2497,23 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {
             "$Tags.HTTP_CLIENT_IP" {
               it == "0:0:0:0:0:0:0:1" || (endpoint == FORWARDED && it == endpoint.body)
             }
+            "$Tags.NETWORK_CLIENT_IP" {
+              it == "0:0:0:0:0:0:0:1" || (endpoint == FORWARDED && it == endpoint.body)
+            }
           } else {
             "$Tags.PEER_HOST_IPV4" {
               it == "127.0.0.1" || (endpoint == FORWARDED && it == endpoint.body)
             }
             "$Tags.HTTP_CLIENT_IP" {
               it == "127.0.0.1" || (endpoint == FORWARDED && it == endpoint.body)
             }
+            "$Tags.NETWORK_CLIENT_IP" {
+              it == "127.0.0.1" || (endpoint == FORWARDED && it == endpoint.body)
+            }
           }
         } else {
           "$Tags.HTTP_CLIENT_IP" clientIp
+          "$Tags.NETWORK_CLIENT_IP" clientIp
         }
         "$Tags.HTTP_HOSTNAME" address.host
         "$Tags.HTTP_URL" "$expectedUrl"
diff --git a/dd-java-agent/instrumentation/akka/akka-http/akka-http-10.0/src/lagomTest/groovy/LagomTest.groovy b/dd-java-agent/instrumentation/akka/akka-http/akka-http-10.0/src/lagomTest/groovy/LagomTest.groovy
@@ -74,6 +74,7 @@ class LagomTest extends InstrumentationSpecification {
             "$Tags.PEER_HOST_IPV4" '127.0.0.1'
             "$Tags.PEER_PORT" Integer
             "$Tags.HTTP_CLIENT_IP" '127.0.0.1'
+            "$Tags.NETWORK_CLIENT_IP" '127.0.0.1'
             defaultTags()
           }
         }
@@ -121,6 +122,7 @@ class LagomTest extends InstrumentationSpecification {
             "$Tags.PEER_HOST_IPV4" '127.0.0.1'
             "$Tags.PEER_PORT" Integer
             "$Tags.HTTP_CLIENT_IP" '127.0.0.1'
+            "$Tags.NETWORK_CLIENT_IP" '127.0.0.1'
             defaultTags()
           }
         }
diff --git a/dd-java-agent/instrumentation/cxf-2.1/src/latestDepTest/groovy/CxfContextPropagationTest.groovy b/dd-java-agent/instrumentation/cxf-2.1/src/latestDepTest/groovy/CxfContextPropagationTest.groovy
@@ -75,6 +75,7 @@ class CxfContextPropagationTest extends InstrumentationSpecification {
             "$InstrumentationTags.SERVLET_PATH" "/test"
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             withCustomIntegrationName("jetty-server")
             defaultTags()
           }
diff --git a/dd-java-agent/instrumentation/cxf-2.1/src/test/groovy/CxfContextPropagationTest.groovy b/dd-java-agent/instrumentation/cxf-2.1/src/test/groovy/CxfContextPropagationTest.groovy
@@ -73,6 +73,7 @@ class CxfContextPropagationTest extends InstrumentationSpecification {
             "servlet.path" { it == null || it == "/test" }
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             withCustomIntegrationName("jetty-server")
             defaultTags()
           }
diff --git a/dd-java-agent/instrumentation/jsp-2.3/src/test/groovy/JSPInstrumentationBasicTests.groovy b/dd-java-agent/instrumentation/jsp-2.3/src/test/groovy/JSPInstrumentationBasicTests.groovy
@@ -37,6 +37,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/$jspFileName"
             defaultTags()
@@ -114,6 +115,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/getQuery.jsp"
             defaultTags()
@@ -187,6 +189,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/post.jsp"
             defaultTags()
@@ -256,6 +259,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 500
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/$jspFileName"
             "error.type" { String tagExceptionType ->
@@ -345,6 +349,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/includes/includeHtml.jsp"
             defaultTags()
@@ -414,6 +419,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/includes/includeMulti.jsp"
             defaultTags()
@@ -537,6 +543,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 500
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/$jspFileName"
             errorTags(JasperException, String)
@@ -602,6 +609,7 @@ class JSPInstrumentationBasicTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/$staticFile"
             defaultTags()
diff --git a/dd-java-agent/instrumentation/jsp-2.3/src/test/groovy/JSPInstrumentationForwardTests.groovy b/dd-java-agent/instrumentation/jsp-2.3/src/test/groovy/JSPInstrumentationForwardTests.groovy
@@ -34,6 +34,7 @@ class JSPInstrumentationForwardTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/$forwardFromFileName"
             defaultTags()
@@ -136,6 +137,7 @@ class JSPInstrumentationForwardTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/forwards/forwardToHtml.jsp"
             defaultTags()
@@ -205,6 +207,7 @@ class JSPInstrumentationForwardTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/forwards/forwardToIncludeMulti.jsp"
             defaultTags()
@@ -358,6 +361,7 @@ class JSPInstrumentationForwardTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/forwards/forwardToJspForward.jsp"
             defaultTags()
@@ -483,6 +487,7 @@ class JSPInstrumentationForwardTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 500
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/forwards/forwardToCompileError.jsp"
             errorTags(JasperException, String)
@@ -569,6 +574,7 @@ class JSPInstrumentationForwardTests extends JSPTestBase {
             "$Tags.HTTP_STATUS" 404
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "servlet.context" "/$jspWebappContext"
             "servlet.path" "/forwards/forwardToNonExistent.jsp"
             defaultTags()
diff --git a/dd-java-agent/instrumentation/mule-4.5/src/test/groovy/mule4/MuleForkedTest.groovy b/dd-java-agent/instrumentation/mule-4.5/src/test/groovy/mule4/MuleForkedTest.groovy
@@ -115,6 +115,7 @@ class MuleForkedTest extends WithHttpServer<MuleTestContainer> {
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.PEER_HOST_IPV4" "127.0.0.1"
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "$Tags.PEER_PORT" { true } // is this really the best way to ignore tags?
             defaultTags()
           }
@@ -174,6 +175,7 @@ class MuleForkedTest extends WithHttpServer<MuleTestContainer> {
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.PEER_HOST_IPV4" "127.0.0.1"
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             "$Tags.PEER_PORT" { Integer }
             defaultTags()
           }
diff --git a/dd-java-agent/instrumentation/play/play-2.3/src/test/groovy/datadog/trace/instrumentation/play23/test/server/PlayServerTest.groovy b/dd-java-agent/instrumentation/play/play-2.3/src/test/groovy/datadog/trace/instrumentation/play23/test/server/PlayServerTest.groovy
@@ -55,7 +55,8 @@ class PlayServerTest extends HttpServerTest<TestServer> {
         "$Tags.COMPONENT" PlayHttpServerDecorator.DECORATE.component()
         "$Tags.SPAN_KIND" Tags.SPAN_KIND_SERVER
         "$Tags.PEER_HOST_IPV4" (endpoint == FORWARDED ? endpoint.body : "127.0.0.1")
-        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? endpoint.body : "127.0.0.1")
+        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
+        "$Tags.NETWORK_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
         "$Tags.HTTP_URL" String
         "$Tags.HTTP_HOSTNAME" address.host
         "$Tags.HTTP_METHOD" String
diff --git a/dd-java-agent/instrumentation/play/play-2.6/src/testFixtures/groovy/datadog/trace/instrumentation/play26/server/AbstractPlayServerTest.groovy b/dd-java-agent/instrumentation/play/play-2.6/src/testFixtures/groovy/datadog/trace/instrumentation/play26/server/AbstractPlayServerTest.groovy
@@ -135,7 +135,8 @@ class AbstractPlayServerTest extends HttpServerTest<Server> {
         "$Tags.COMPONENT" PlayHttpServerDecorator.DECORATE.component()
         "$Tags.SPAN_KIND" Tags.SPAN_KIND_SERVER
         "$Tags.PEER_HOST_IPV4" '127.0.0.1'
-        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? endpoint.body : '127.0.0.1')
+        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
+        "$Tags.NETWORK_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
         "$Tags.HTTP_URL" String
         "$Tags.HTTP_HOSTNAME" address.host
         "$Tags.HTTP_METHOD" String
diff --git a/dd-java-agent/instrumentation/play/play-appsec-2.5/src/test/groovy/datadog/trace/instrumentation/play25/server/PlayScalaRoutesServerTest.groovy b/dd-java-agent/instrumentation/play/play-appsec-2.5/src/test/groovy/datadog/trace/instrumentation/play25/server/PlayScalaRoutesServerTest.groovy
@@ -99,7 +99,8 @@ class PlayScalaRoutesServerTest extends PlayServerTest {
         "$Tags.COMPONENT" 'play-action'
         "$Tags.SPAN_KIND" Tags.SPAN_KIND_SERVER
         "$Tags.PEER_HOST_IPV4" (endpoint == FORWARDED ? endpoint.body : '127.0.0.1')
-        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? endpoint.body : '127.0.0.1')
+        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
+        "$Tags.NETWORK_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
         "$Tags.HTTP_URL" String
         "$Tags.HTTP_HOSTNAME" address.host
         "$Tags.HTTP_METHOD" String
diff --git a/dd-java-agent/instrumentation/play/play-appsec-2.5/src/test/groovy/datadog/trace/instrumentation/play25/server/PlayServerTest.groovy b/dd-java-agent/instrumentation/play/play-appsec-2.5/src/test/groovy/datadog/trace/instrumentation/play25/server/PlayServerTest.groovy
@@ -131,7 +131,8 @@ class PlayServerTest extends HttpServerTest<Server> {
         "$Tags.COMPONENT" PlayHttpServerDecorator.DECORATE.component()
         "$Tags.SPAN_KIND" Tags.SPAN_KIND_SERVER
         "$Tags.PEER_HOST_IPV4" (endpoint == FORWARDED ? endpoint.body : "127.0.0.1")
-        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? endpoint.body : "127.0.0.1")
+        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
+        "$Tags.NETWORK_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
         "$Tags.HTTP_URL" String
         "$Tags.HTTP_HOSTNAME" address.host
         "$Tags.HTTP_METHOD" String
diff --git a/dd-java-agent/instrumentation/play/play-appsec-2.7/src/test/groovy/datadog/trace/instrumentation/play27/server/test/PlayAsyncServerRoutesScalaWithErrorHandlerTest.groovy b/dd-java-agent/instrumentation/play/play-appsec-2.7/src/test/groovy/datadog/trace/instrumentation/play27/server/test/PlayAsyncServerRoutesScalaWithErrorHandlerTest.groovy
@@ -87,7 +87,8 @@ class PlayAsyncServerRoutesScalaWithErrorHandlerTest extends AbstractPlayServer2
         "$Tags.COMPONENT" PlayHttpServerDecorator.DECORATE.component()
         "$Tags.SPAN_KIND" Tags.SPAN_KIND_SERVER
         "$Tags.PEER_HOST_IPV4" '127.0.0.1'
-        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? endpoint.body : "127.0.0.1")
+        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
+        "$Tags.NETWORK_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
         "$Tags.HTTP_URL" String
         "$Tags.HTTP_HOSTNAME" address.host
         "$Tags.HTTP_METHOD" String
diff --git a/dd-java-agent/instrumentation/ratpack-1.5/src/test/groovy/RatpackOtherTest.groovy b/dd-java-agent/instrumentation/ratpack-1.5/src/test/groovy/RatpackOtherTest.groovy
@@ -80,6 +80,7 @@ class RatpackOtherTest extends InstrumentationSpecification {
             "$Tags.HTTP_ROUTE" "/$route"
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             defaultTags()
           }
         }
@@ -100,6 +101,7 @@ class RatpackOtherTest extends InstrumentationSpecification {
             "$Tags.HTTP_STATUS" 200
             "$Tags.HTTP_ROUTE" "/$route"
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             defaultTags()
           }
         }
diff --git a/dd-java-agent/instrumentation/ratpack-1.5/src/test/groovy/server/RatpackHttpServerTest.groovy b/dd-java-agent/instrumentation/ratpack-1.5/src/test/groovy/server/RatpackHttpServerTest.groovy
@@ -142,7 +142,8 @@ class RatpackHttpServerTest extends HttpServerTest<EmbeddedApp> {
         "$Tags.HTTP_METHOD" String
         "$Tags.HTTP_STATUS" Integer
         "$Tags.HTTP_ROUTE" String
-        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? endpoint.body : '127.0.0.1')
+        "$Tags.HTTP_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
+        "$Tags.NETWORK_CLIENT_IP" (endpoint == FORWARDED ? { it == endpoint.body || it == '127.0.0.1' } : '127.0.0.1')
         if (endpoint == EXCEPTION) {
           errorTags(Exception, EXCEPTION.body)
         }
diff --git a/dd-java-agent/instrumentation/reactor-netty-1.0/src/test/groovy/ReactorNettyHttp2ClientTest.groovy b/dd-java-agent/instrumentation/reactor-netty-1.0/src/test/groovy/ReactorNettyHttp2ClientTest.groovy
@@ -110,6 +110,7 @@ class ReactorNettyHttp2ClientTest extends InstrumentationSpecification {
             "$Tags.PEER_PORT" Integer
             "$Tags.PEER_HOST_IPV4" { String }
             "$Tags.HTTP_CLIENT_IP" { String }
+            "$Tags.NETWORK_CLIENT_IP" { String }
 
             "$Tags.HTTP_HOSTNAME" { String }
             "$Tags.HTTP_URL" "http://localhost:${server.port()}/firstUrl"
@@ -132,6 +133,7 @@ class ReactorNettyHttp2ClientTest extends InstrumentationSpecification {
               "$Tags.PEER_PORT" Integer
               "$Tags.PEER_HOST_IPV4" { String }
               "$Tags.HTTP_CLIENT_IP" { String }
+              "$Tags.NETWORK_CLIENT_IP" { String }
 
               "$Tags.HTTP_HOSTNAME" { String }
               "$Tags.HTTP_URL" "http://localhost:${server.port()}/"
diff --git a/dd-java-agent/instrumentation/spark/sparkjava-2.3/src/test/groovy/SparkJavaBasedTest.groovy b/dd-java-agent/instrumentation/spark/sparkjava-2.3/src/test/groovy/SparkJavaBasedTest.groovy
@@ -63,6 +63,7 @@ class SparkJavaBasedTest extends InstrumentationSpecification {
             "$Tags.HTTP_ROUTE" String
             "$Tags.HTTP_USER_AGENT" String
             "$Tags.HTTP_CLIENT_IP" "127.0.0.1"
+            "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"
             defaultTags()
           }
         }
diff --git a/dd-java-agent/instrumentation/spring/spring-webflux/spring-webflux-5.0/src/bootTest/groovy/SpringWebfluxTest.groovy b/dd-java-agent/instrumentation/spring/spring-webflux/spring-webflux-5.0/src/bootTest/groovy/SpringWebfluxTest.groovy
diff --git a/dd-java-agent/instrumentation/spring/spring-webflux/spring-webflux-6.0/src/bootTest/groovy/SpringWebfluxTest.groovy b/dd-java-agent/instrumentation/spring/spring-webflux/spring-webflux-6.0/src/bootTest/groovy/SpringWebfluxTest.groovy
diff --git a/dd-java-agent/instrumentation/spring/spring-webmvc/spring-webmvc-3.1/src/test/groovy/test/boot/SpringBootBasedTest.groovy b/dd-java-agent/instrumentation/spring/spring-webmvc/spring-webmvc-3.1/src/test/groovy/test/boot/SpringBootBasedTest.groovy
diff --git a/dd-java-agent/instrumentation/spring/spring-ws-2.0/src/test/groovy/SpringWebServiceTest.groovy b/dd-java-agent/instrumentation/spring/spring-ws-2.0/src/test/groovy/SpringWebServiceTest.groovy
diff --git a/dd-java-agent/instrumentation/synapse-3.0/src/test/groovy/datadog/trace/instrumentation/synapse3/SynapseTest.groovy b/dd-java-agent/instrumentation/synapse-3.0/src/test/groovy/datadog/trace/instrumentation/synapse3/SynapseTest.groovy
diff --git a/dd-java-agent/instrumentation/tomcat/tomcat-5.5/src/latestDepTest/groovy/TomcatNoPropagationForkedTest.groovy b/dd-java-agent/instrumentation/tomcat/tomcat-5.5/src/latestDepTest/groovy/TomcatNoPropagationForkedTest.groovy
diff --git a/dd-java-agent/instrumentation/wildfly-9.0/src/test/groovy/WildFlyForkedTest.groovy b/dd-java-agent/instrumentation/wildfly-9.0/src/test/groovy/WildFlyForkedTest.groovy
diff --git a/dd-smoke-tests/appsec/springboot/src/test/groovy/datadog/smoketest/appsec/SpringBootSmokeTest.groovy b/dd-smoke-tests/appsec/springboot/src/test/groovy/datadog/smoketest/appsec/SpringBootSmokeTest.groovy
diff --git a/internal-api/src/main/java/datadog/trace/bootstrap/instrumentation/api/Tags.java b/internal-api/src/main/java/datadog/trace/bootstrap/instrumentation/api/Tags.java

Original file line number	Diff line number	Diff line change
`@@ -370,6 +370,9 @@ public AgentSpan onRequest(`
`370`	`370`	`} else {`
`371`	`371`	`span.setTag(Tags.PEER_HOST_IPV4, peerIp);`
`372`	`372`	`}`
	`373`	`+ if (clientIpResolverEnabled) {`
	`374`	`+ span.setTag(Tags.NETWORK_CLIENT_IP, peerIp);`
	`375`	`+ }`
`373`	`376`	`}`
`374`	`377`	`setPeerPort(span, peerPort);`
`375`	`378`	`Flow<Void> flow = callIGCallbackAddressAndPort(span, peerIp, peerPort, inferredAddressStr);`
Original file line number	Diff line number	Diff line change
`@@ -2497,16 +2497,23 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {`
`2497`	`2497`	`"$Tags.HTTP_CLIENT_IP" {`
`2498`	`2498`	`it == "0:0:0:0:0:0:0:1" \|\| (endpoint == FORWARDED && it == endpoint.body)`
`2499`	`2499`	`}`
	`2500`	`+ "$Tags.NETWORK_CLIENT_IP" {`
	`2501`	`+ it == "0:0:0:0:0:0:0:1" \|\| (endpoint == FORWARDED && it == endpoint.body)`
	`2502`	`+ }`
`2500`	`2503`	`} else {`
`2501`	`2504`	`"$Tags.PEER_HOST_IPV4" {`
`2502`	`2505`	`it == "127.0.0.1" \|\| (endpoint == FORWARDED && it == endpoint.body)`
`2503`	`2506`	`}`
`2504`	`2507`	`"$Tags.HTTP_CLIENT_IP" {`
`2505`	`2508`	`it == "127.0.0.1" \|\| (endpoint == FORWARDED && it == endpoint.body)`
`2506`	`2509`	`}`
	`2510`	`+ "$Tags.NETWORK_CLIENT_IP" {`
	`2511`	`+ it == "127.0.0.1" \|\| (endpoint == FORWARDED && it == endpoint.body)`
	`2512`	`+ }`
`2507`	`2513`	`}`
`2508`	`2514`	`} else {`
`2509`	`2515`	`"$Tags.HTTP_CLIENT_IP" clientIp`
	`2516`	`+ "$Tags.NETWORK_CLIENT_IP" clientIp`
`2510`	`2517`	`}`
`2511`	`2518`	`"$Tags.HTTP_HOSTNAME" address.host`
`2512`	`2519`	`"$Tags.HTTP_URL" "$expectedUrl"`
Original file line number	Diff line number	Diff line change
`@@ -74,6 +74,7 @@ class LagomTest extends InstrumentationSpecification {`
`74`	`74`	`"$Tags.PEER_HOST_IPV4" '127.0.0.1'`
`75`	`75`	`"$Tags.PEER_PORT" Integer`
`76`	`76`	`"$Tags.HTTP_CLIENT_IP" '127.0.0.1'`
	`77`	`+ "$Tags.NETWORK_CLIENT_IP" '127.0.0.1'`
`77`	`78`	`defaultTags()`
`78`	`79`	`}`
`79`	`80`	`}`
`@@ -121,6 +122,7 @@ class LagomTest extends InstrumentationSpecification {`
`121`	`122`	`"$Tags.PEER_HOST_IPV4" '127.0.0.1'`
`122`	`123`	`"$Tags.PEER_PORT" Integer`
`123`	`124`	`"$Tags.HTTP_CLIENT_IP" '127.0.0.1'`
	`125`	`+ "$Tags.NETWORK_CLIENT_IP" '127.0.0.1'`
`124`	`126`	`defaultTags()`
`125`	`127`	`}`
`126`	`128`	`}`
Original file line number	Diff line number	Diff line change
`@@ -75,6 +75,7 @@ class CxfContextPropagationTest extends InstrumentationSpecification {`
`75`	`75`	`"$InstrumentationTags.SERVLET_PATH" "/test"`
`76`	`76`	`"$Tags.HTTP_USER_AGENT" String`
`77`	`77`	`"$Tags.HTTP_CLIENT_IP" "127.0.0.1"`
	`78`	`+ "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"`
`78`	`79`	`withCustomIntegrationName("jetty-server")`
`79`	`80`	`defaultTags()`
`80`	`81`	`}`
Original file line number	Diff line number	Diff line change
`@@ -73,6 +73,7 @@ class CxfContextPropagationTest extends InstrumentationSpecification {`
`73`	`73`	`"servlet.path" { it == null \|\| it == "/test" }`
`74`	`74`	`"$Tags.HTTP_USER_AGENT" String`
`75`	`75`	`"$Tags.HTTP_CLIENT_IP" "127.0.0.1"`
	`76`	`+ "$Tags.NETWORK_CLIENT_IP" "127.0.0.1"`
`76`	`77`	`withCustomIntegrationName("jetty-server")`
`77`	`78`	`defaultTags()`
`78`	`79`	`}`