An IP address doesn't execute a command. Commands are always executed by a program that runs locally. Normally the relevant forensic information regarding who ran a command is the user who ran this program.
It is possible to trace back a command to a server that listens for input over the network, e.g. find that some command was launched from a session that was created by an SSH server process and then find what remote machine that server process is listening to. If the command is executed in a terminal, then this information can be obtained by checking which terminal the command is executed in and running
who to see which user is executing this command and where they logged in from. After the fact, the association between time, user terminal and IP address can be accessed with
Individual commands are not logged by default. If you want to do that, you have to set it up. An easy, low-overhead way is with process accounting: install
acct, make sure that the service is enabled, and then each individual command (but not its argument) is logged. Run
lastcomm to see the log associating commands, times and terminals. You can then cross the information with the IP addresses reported by