Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passive TCP/IP Geo-Location

geoloc.foremski.pl

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Passive TCP/IP Geo-Location

#51

Post by chias »

lucb1e wrote: post #30

I did this a few years ago, a simple tool that pinged places all over the world and calculated where you should be. This only ever gets as close as your ISP, or perhaps a local routing center if your ISP has multiple (mine has only one in Amsterdam, I live on the other side of the country). This means it's less accurate than your typical GeoIP database. Edit: I'm no longer sure this is the same. The title mentions "p…

It isn't passive. See lines 64-73 of the code [1]. This seems very similar to what you describe, but rather than you pinging a bunch of places around the world, it has a bunch of places around the world essentially pinging you.

If you check the HTML source, it's src'ing scripts from machines around the world (I assume whatever host is being used, the author has spun up a VPN in each of their data centers). Here's an example of one [2]. Each of these sends you a constant value over and over again, and the server side measures the latency, before finally reporting the average round-trip time to you.

[1]: http://geoloc.foremski.pl/tcpinfo.go

[2]: http://46.101.226.53/DE_Frankfurt.js

Re: Passive TCP/IP Geo-Location

#52

Post by rmdoss »

Really cool tool.

If he added a few more servers and set a max ping rt it would become a lot more accurate.

And it doesn't really replace geoip, but implemented correctly can be used very affectively for latency based routing (similar to what AWS has).

Re: Passive TCP/IP Geo-Location

#54

Post by jimktrains2 »

dzhiurgis wrote: post #39

I have a question about geolocation when using Google Compute. All of the geolocation services identify my server as US based, when in fact it is located in asia (ping and traceroute reveals). Was wondering perhaps HN big heads can explain it to me:) I suspect it is somehow related to how Google operates its SDN and that IP is assigned to massive AS block. Nevertheless, I think there is a decent performance risk when…

GeoIP databases work based on the _owner_ of the IP address. The owner can cooperate with a geoip database and provide more granular locations for the blocks they use. Others, like Google apparently, don't and as such, you'll show up as the registered address for the allocated block.

Re: Passive TCP/IP Geo-Location

#55

Post by jimktrains2 »

avodonosov wrote: post #43
SomewhatLikely wrote: post #31

Earlier quoted context omitted.

I think that means you're in Europe.

I am. How do you see this?

The circle around the Indian Ocean, and the 2 near/over South America are inverted. _Inside_ the circle is where you aren't. As such Europe is the place where all circles overlap.

Re: Passive TCP/IP Geo-Location

#56

Post by nathancahill »

kerkeslager wrote: post #46

Little Snitch[1] does a very good job of preventing this sort of attack. Even if they give names to the servers that make me think they're something I want to allow, the time I spend clicking the "Allow" button is well outside the margin of error of the latency measurements. I'm in NYC and the tool places me in Frankfort, Germany. +1 for Little Snitch. [1] https://www.obdev.at/products/littlesnitch/index.html

Yes, I use and love Little Snitch too, but don't you have a rule that says Browser = Allow all?

Re: Passive TCP/IP Geo-Location

#57

Post by cynwoody »

alpb wrote: post #36

Honestly this does not seem to be a very smart thing to do at all. Your ping times is probably just going to reveal on which coast of US you are on (unless you're speedtest.com or something like that). If you want city-level accuracy, at least in US, just use geo IP lookup: https://geoiptool.com/ This finds my city perfectly, unlike the link above (which says I'm somewhere on US West coast).

Geoiptool thinks I'm in Romania. As does Maxmind's free IP location database[1]. However, Google thinks I'm in New Delhi, until I grant permission to upload my actual location. Then it puts the marker right on my rooftop in Massachusetts.

I'm actually using a VPN (euro214.vpnbook.com), which, based on the name, should be somewhere in Europe. But who knows? If I disconnect the VPN, Google and Geoiptool both get my town right, and Maxmind is one town over. I'm using Verizon FiOS.

As for the geolocator, the ping times range from 172 ms (Frankfurt, Germany) to 524 ms (Singapore). Too large to be of use. With the VPN disconnected, it lucks out with a 12 ms ping to New York, resulting in a yellow circle accurately indicating that I am in the northeast US.

Looking at the no-VPN map[2], there are small circles corresponding the antipodes[3] of Singapore (purple) and Bangalore (blue). Without the New York ping, the map would be completely useless.

[1]https://dev.maxmind.com/geoip/geoip2/geolite2/

[2]https://i.imgur.com/nKw8u1D.png

[3]http://www.antipodesmap.com/

Re: Passive TCP/IP Geo-Location

#58

Post by tedmiston »

whorleater wrote: post #15
IshKebab wrote: post #10

The ping times seem sensible, but I can't work out any correlation between them and the map. Just seems like a random collection of circles...

I assume each circle has a radius proportional to the rtt, thus the area in which the circles overlap is roughly where you should be. The limited amount of servers + wide range of rtt gives a massive margin of errors, but this is probably easily improvable through some extra servers and some kind of knn-ish analysis.

The best circle is about 1500 miles off from my actual location. The most overlapped area isn't even in the right continent, let alone country. I think massive margin of error is a bit of an understatement.

Re: Passive TCP/IP Geo-Location

#59

Post by tedmiston »

alpb wrote: post #36

Honestly this does not seem to be a very smart thing to do at all. Your ping times is probably just going to reveal on which coast of US you are on (unless you're speedtest.com or something like that). If you want city-level accuracy, at least in US, just use geo IP lookup: https://geoiptool.com/ This finds my city perfectly, unlike the link above (which says I'm somewhere on US West coast).

How does Geo IP Tool make these predictions? Like, where is the data it's associating my IP with coming from or how are they obtaining it?
Post reply on HN