Re: I wish I had more upvotes to give
"IPv4 or IPv6 gives the IP of that connection at that particular moment in time."
When ISPs are dynamically multiplexing several users onto one external IPv4 address - then it is the changing source port numbers that have to be tracked and matched as well. The port number can be any one of about 64,000 numbers. The multiplexing of several users concurrently is how real world IPv4 address shortages have been staved off for so long. Any port number may be assigned to a user's connection for only a few minutes - before becoming free and then re-assigned to someone else.
It is not unknown for that multiplexing process to take place more than once in a connection's path - not necessarily in the same ISP's network. It can be very tricky, if not nigh on impossible, to untangle such a trail from normal logging.
Even a home router will multiplex several devices onto one ISP internal IPv4 address by dynamically allocating source port numbers as connections are made and broken.