Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passive TCP/IP Geo-Location

geoloc.foremski.pl

Post reply on HN
Print view View original

31–40 of 91 posts

Re: Passive TCP/IP Geo-Location

#32

Post by lucb1e »

chinathrow wrote: post #9
aw3c2 wrote: post #2

> This website demonstrates IP address geo-location by passively measuring TCP/IP round-trip times of web requests made to a few servers spread around the world. I don't get how that could be called passive. This is making your browser issue requests or am I missing something?

I think the author means passive in a way that no known geoip DB is used.

That would be the opposite of passive: using a geoIP database is passive; probing from/to various locations is active.

Another comment mentioned someone monitoring your traffic and noting your RTT (roundtrip time) for various IP addresses around the world. That seems much more likely.

Re: Passive TCP/IP Geo-Location

#33

Post by SomewhatLikely »

HowardStark wrote: post #3
aw3c2 wrote: post #2

> This website demonstrates IP address geo-location by passively measuring TCP/IP round-trip times of web requests made to a few servers spread around the world. I don't get how that could be called passive. This is making your browser issue requests or am I missing something?

I believe the author's point was you could determine the location by monitoring other applications and their network calls. That being said, I highly doubt there are many requests being made to Bangalore, India and this appears to require requests to a wide array of locations all over the world.

On the contrary, it appears the most accurate servers are ones nearby, which you'd contact a lot if CDNs are doing their job right.

Re: Passive TCP/IP Geo-Location

#34

Post by lucb1e »

HowardStark wrote: post #3
aw3c2 wrote: post #2

> This website demonstrates IP address geo-location by passively measuring TCP/IP round-trip times of web requests made to a few servers spread around the world. I don't get how that could be called passive. This is making your browser issue requests or am I missing something?

I believe the author's point was you could determine the location by monitoring other applications and their network calls. That being said, I highly doubt there are many requests being made to Bangalore, India and this appears to require requests to a wide array of locations all over the world.

Aside from the disproportional amount of traffic going to America (I'm from Europe), there was still a significant portion of traffic that went all over the world when I last checked for my private traffic.

Additionally I once made a map of destinations from our school's "security lab" network. This is 30 minutes of traffic: https://snag.gy/aJqrg2.jpg

The map is a modified version of the one generated by Wireshark (circles are proportional to the amount of data going from/to that IP address). It seems to use Maxmind's GeoIP database.

Re: Passive TCP/IP Geo-Location

#36

Post by alpb »

Honestly this does not seem to be a very smart thing to do at all. Your ping times is probably just going to reveal on which coast of US you are on (unless you're speedtest.com or something like that).

If you want city-level accuracy, at least in US, just use geo IP lookup: https://geoiptool.com/ This finds my city perfectly, unlike the link above (which says I'm somewhere on US West coast).

Re: Passive TCP/IP Geo-Location

#37

Post by _ao789 »

alpb wrote: post #36

Honestly this does not seem to be a very smart thing to do at all. Your ping times is probably just going to reveal on which coast of US you are on (unless you're speedtest.com or something like that). If you want city-level accuracy, at least in US, just use geo IP lookup: https://geoiptool.com/ This finds my city perfectly, unlike the link above (which says I'm somewhere on US West coast).

The whole point is to not use a geoip database and instead attempt to find your location from numerous server requests. Hence 'concept' as this wouldn't really be feasible for any real world usecase.

Re: Passive TCP/IP Geo-Location

#39

Post by dzhiurgis »

I have a question about geolocation when using Google Compute. All of the geolocation services identify my server as US based, when in fact it is located in asia (ping and traceroute reveals).

Was wondering perhaps HN big heads can explain it to me:) I suspect it is somehow related to how Google operates its SDN and that IP is assigned to massive AS block.

Nevertheless, I think there is a decent performance risk when CDNs serve from US based cache rather than local.

Post reply on HN