>>But a question (maybe a stupid question) - as far as SQL Server is concerned, isn't the request coming first through the web server? (I'm assuming you're trying to trace IP addresses from the outside). Can't your web app/web server capture the IP addresses in web logs?
>
>No, not in that case. We have an external source who built a .NET application using the .NET SQL Client Data Provider to query our database directly. This is still under investigation. We have not yet found who authorized this.

Did you check http://stackoverflow.com/questions/9941074/how-to-get-the-client-ip-address-from-sql-server-2008-itself