Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Silver

Find ip location.

How could i find some one ip address location?

---

Posted by WebUser Aftab Uddin Tohan

3 REPLIES
Hall of Fame Super Silver

Re: Find ip location.

Are you asking about a public IP or one on your network?

For a public IP, the best you can generally do is look up the network block registration. Go to one of the Regional Internet Registries (RIRs) and use their whois function. If the network is allocated by the one you look at, you'll see the registered organization and their contact info. If it's not allocated out of that RIR, there will be a reference to the allocating RIR.

https://www.arin.net/knowledge/rirs.html

If it's on your network, traceroute to it to find the default gateway. Determine if it's directly attached to that gateway or a downstream switch by inspecting the arp cache and/or mac address-table. Repeat as necessary until you get to the port level. Trace cable as required.

If it's a wi-fi client, the best you can do (without an air sniffer sort of tool) using the above is to narrow it down to the general region of the serving access point. Other forensics such as a capture of the client's traffic may reveal enough information to identify the actual host - or it might not.

Hope this helps.

New Member

Find ip location.

If it's an address on your own network, a simple trick that you can use is to create reverse DNS entries that include some useful location information.  This is particularly handy when your network spans multiple geographic areas, although you could also break it down by locations within a particular site.  For instance, you could use an entry like pc238.thirdfloor-researchlabs-toronto.mycompany.com to indicate that a given address is assigned to machine #238, on the third floor research labs of a Toronto site. 

This approach does require administrative work and planning, but the work pays off quickly in a network of even moderate complexity.  Of course, if you're looking for the location of an external IP address, this won't help - in that case, you can follow Marvin's tip on looking through the RIR allocations.  You can also usually get a quick idea of where an address is using tools like whois.

As if all that isn't useful enough, you can also find a variety of geolocation databases for download.  These tend to be regularly updated, and depending on how much money you're willing to shell out, may be fairly specific or fairly general, but they give you some additional options.  As an example of how this is useful, I was recently working on a DDOS attack at my workplace, and by taking the IPs of several thousand attacking hosts, I was able to use a local copy of a geolocation database to very quickly narrow down the countries where the bulk of the attacks were coming from, and using the same database I generated some ACLs that would block access to networks assigned to entire countries for the duration of the DDOS attack.

Hall of Fame Super Gold

Find ip location.

How could i find some one ip address location?

Can you elaborate further?

912
Views
0
Helpful
3
Replies
CreatePlease to create content