This notification-carried IpAddress identifies either the attacking end station's IP address, or, if the DoS packet did not originate from a directly attached station, the router's IP address instead. An admin uses this value in the trap to trace where a detected attack is coming from, which is the first step toward blocking or further investigating the source. For example, a trap carrying 203.0.113.45 as this value would point the admin toward that specific attacking host for follow-up action.