Traceroute • Hacker News Board

csvoss wrote: post #23

Update: I've downloaded the GeoLite data from April 2015, replacing the old March 2014 data! You should now be seeing more accurate results. :)

Still not very accurate. It thinks my DigitalOcean droplet is in Russia. (actually in London)

Re: Traceroute

#25

Post by matthewbauer » Tue, Aug 25, 2015, 8:05 PM UTC

Geo lookup for some IPs will resolve to "US" which resolves to that long/lat in the middle of Kansas in case anyone was confused.

Re: Traceroute

#26

Post by DINKDINK » Tue, Aug 25, 2015, 8:06 PM UTC

I've always described this as a visual, rather than text-based, traceroute. The site might benefit from keyword searching if visual traceroute was included.

Prior art: http://www.monitis.com/traceroute/

Re: Traceroute

#27

Post by RankingMember » Tue, Aug 25, 2015, 8:14 PM UTC

Isn't this just like the visual traceroute from http://www.yougetsignal.com/tools/visual-tracert ?

Re: Traceroute

#28

Post by geofft » Tue, Aug 25, 2015, 8:16 PM UTC

evandrix wrote: post #3

any chance tracing to a malicious server via this can attack scripts.mit.edu?

All I can think of is stuff like DNS cache poisoning from forcing lookups, which shouldn't be a threat these days (and there are infinite other ways to force the server to do DNS lookups). The purpose of scripts.mit.edu involves students and faculty running old versions of WordPress and writing custom PHP to learn the language, so the threat model very much assumes that malicious people have compromised at least one unprivileged account at any given time. Hostname lookups are a drop in the bucket compared to that.

Re: Traceroute

#29

Post by jakeway » Tue, Aug 25, 2015, 8:43 PM UTC

A bit unrelated... but I find it interesting that the same person who programmed this (csvoss on github) is also the developer of two other projects trending on HN right now.

Python oneliner: https://news.ycombinator.com/item?id=10114969

Retroactive data structures: https://news.ycombinator.com/item?id=10119065

Coincidence? Or is this just a slow hour on HN and good time to get submissions on front page?

Re: Traceroute

#30

Post by _jomo » Tue, Aug 25, 2015, 8:51 PM UTC

foobarbecue wrote: post #20

Why does 1.1.1.1 land you at google headquarters? Whois says APNIC-LABS in Australia, but apparently this subnet is "routed briefly for passive testing".

1.1.1.0/24 [0] is described as "Research prefix for APNIC Labs", but it is part of AS15169 [1] which is "Google Inc."

Also part of that AS are 1.0.0.0/24 [2] and 1.2.3.0/24 "APNIC Debogon Project" [3]. Wikipedia has some information about Bogon filtering [4] and there have been some publications about the Debogon Project [5].

The now assigned addresses used to be unassigned "bogon" addresses, which are now assigned. I'm not sure why it's part of the Google AS, though. Maybe only because they get to see a lot of traffic?

0: http://ipinfo.io/AS15169/1.1.1.0/24

1: http://ipinfo.io/AS15169

2: http://ipinfo.io/AS15169/1.0.0.0/24

3: http://ipinfo.io/AS15169/1.2.3.0/24

4: https://en.wikipedia.org/wiki/Bogon_filtering

5: http://meetings.apnic.net/__data/assets/pdf_file/0019/18811/...