IP is not a text format (like HTTP). It's a binary format where each field of the IPv4 header has an exactly defined offset and length. The source IP address is placed at offset 96 and has a length of 32 bit, the destination IP address sits right afterwards with the same length. Changing anything will result in new protocol definition, et voilà that's IPv6.
They don't need correlation. Operating large numbers of nodes gives them a high enough probability that all three hops may be under their control thus they can observe the entire route.
I was astonished about the rapid expansion of the list of cyber warfare forces in recent years and by the incredible mass of cyber warfare capabilities of the United States.
https://en.wikipedia.org/wiki/Internet_Protocol_version_4#He...