4 ms·

IP Geolocation Through Reverse DNS

68 points by adulau 8y ago

golanggeek 8y ago
Is there any implementation yet on how this could be done?
chrisweekly 8y ago
> IP Geolocation databases are widely used in online services to map end user IP addresses to their geographical locations. However, they use proprietary geolocation methods and in some cases they have poor accuracy. We propose a systematic approach to use publicly accessible reverse DNS hostnames for geolocating IP addresses. Our method is designed to be combined with other geolocation data sources. We cast the task as a machine learning problem where for a given hostname, we generate and rank a list of potential location candidates. We evaluate our approach against three state of the art academic baselines and two state of the art commercial IP geolocation databases. We show that our work significantly outperforms the academic baselines, and is complementary and competitive with commercial databases. To aid reproducibility, we open source our entire approach. (abstract from the linked article)
- golanggeek 8y ago
  > To aid reproducibility, we open source our entire approach. Only the approach as how to do it is open sourced or is there an implementation associated with it.
lathiat 8y ago
Paper seems to miss to me the obvious approach of not only reverse lookups on the target IP but the last few hops in the trace route to the IP
- billyhoffman 8y ago
  That's a neat suggestion to extend this approach. However a key consideration mentioned in the paper was speed and scale. Their approach requires 1 reverse DNS lookup, not running a traceroute to the IP to determine its location
- est 8y ago
  I have done this, but found that often there are multiple routes available. I haven't figured out an efficient way to filter or index this yet.
justizin 8y ago
Reverse DNS typically puts me thousands of miles away. Full stop.
orliesaurus 8y ago
I was hoping for a Proof Of Concept or a Demo...
dorianm 8y ago
> To aid reproducibility, we open source our entire approach. Probably because it's a draft but I was not able to find any source code (looked up the authors github repos and websites) Also the end of the conclusion is pretty interesting: > Our future work will focus on combining reverse DNS hostname information with WHOIS databases and network delay to form a geolocation database across the entire IP space
phw 8y ago
Ideally, a geolocation system should also work in an adversarial setting, when somebody is trying to spoof their geolocation. We recently learned that some VPN providers do that, to appear to have proxies in more countries: https://research.owlfolio.org/pubs/2018-catch-proxies-lie.pdf https://research.owlfolio.org/pubs/2018-catch-proxies-lie.pd... Obviously, people can lie in their reverse DNS record but active measurements from distributed vantage points (e.g., by using the RIPE Atlas network) could expose that.
- d215 8y ago
  Note that you can use https://ipmap.ripe.net https://ipmap.ripe.net to lookup any IP address and RIPE Atlas measurements will be scheduled in the background to figure out the the location. So no need to schedule measurements manually (requiring credits). We're also working on a reverse DNS geolocating backend BTW. We will look into this paper.
walrus01 8y ago
Trying to say "we can do IP geolocation through rDNS" is a really bad idea. I control several /16 chunks of IP space that through their ARIN WHOIS entry and rDNS could be located anywhere from northwest montana, to the NW corner of WA state, to Eugene OR, to Boise ID, or anywhere in between. Maxmind and other geolocation services are also famously bad. https://www.google.com/search?client=ubuntu&channel=fs&q=maxmind+kansas+farm&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=max...
maslam 8y ago
> To aid reproducibility, we open source our entire approach. Where the code? :/
alam2000 8y ago
Who is the Provider A and Provider B in Figure 7? IP2Location and Maxmind?
coderholic 8y ago
We use rdns hostname data as one of the data sources for our geolocation database at https://ipinfo.io https://ipinfo.io, but some of the ML stuff here is definitely interesting, and we'll be looking integrating some of the more novel techniques covered here!

68 points by adulau 8y ago

Is there any implementation yet on how this could be done?

> IP Geolocation databases are widely used in online services to map end user IP addresses to their geographical locations. However, they use proprietary geolocation methods and in some cases they have poor accuracy. We propose a systematic approach to use publicly accessible reverse DNS hostnames for geolocating IP addresses. Our method is designed to be combined with other geolocation data sources. We cast the task as a machine learning problem where for a given hostname, we generate and rank a list of potential location candidates. We evaluate our approach against three state of the art academic baselines and two state of the art commercial IP geolocation databases. We show that our work significantly outperforms the academic baselines, and is complementary and competitive with commercial databases. To aid reproducibility, we open source our entire approach. (abstract from the linked article)

golanggeek 8y ago
> To aid reproducibility, we open source our entire approach. Only the approach as how to do it is open sourced or is there an implementation associated with it.

lathiat 8y ago

Paper seems to miss to me the obvious approach of not only reverse lookups on the target IP but the last few hops in the trace route to the IP

billyhoffman 8y ago
That's a neat suggestion to extend this approach. However a key consideration mentioned in the paper was speed and scale. Their approach requires 1 reverse DNS lookup, not running a traceroute to the IP to determine its location
est 8y ago
I have done this, but found that often there are multiple routes available. I haven't figured out an efficient way to filter or index this yet.

justizin 8y ago

Reverse DNS typically puts me thousands of miles away. Full stop.

orliesaurus 8y ago

I was hoping for a Proof Of Concept or a Demo...

dorianm 8y ago

> To aid reproducibility, we open source our entire approach. Probably because it's a draft but I was not able to find any source code (looked up the authors github repos and websites) Also the end of the conclusion is pretty interesting: > Our future work will focus on combining reverse DNS hostname information with WHOIS databases and network delay to form a geolocation database across the entire IP space

phw 8y ago

Ideally, a geolocation system should also work in an adversarial setting, when somebody is trying to spoof their geolocation. We recently learned that some VPN providers do that, to appear to have proxies in more countries: https://research.owlfolio.org/pubs/2018-catch-proxies-lie.pdf https://research.owlfolio.org/pubs/2018-catch-proxies-lie.pd... Obviously, people can lie in their reverse DNS record but active measurements from distributed vantage points (e.g., by using the RIPE Atlas network) could expose that.

d215 8y ago
Note that you can use https://ipmap.ripe.net https://ipmap.ripe.net to lookup any IP address and RIPE Atlas measurements will be scheduled in the background to figure out the the location. So no need to schedule measurements manually (requiring credits). We're also working on a reverse DNS geolocating backend BTW. We will look into this paper.

walrus01 8y ago

Trying to say "we can do IP geolocation through rDNS" is a really bad idea. I control several /16 chunks of IP space that through their ARIN WHOIS entry and rDNS could be located anywhere from northwest montana, to the NW corner of WA state, to Eugene OR, to Boise ID, or anywhere in between. Maxmind and other geolocation services are also famously bad. https://www.google.com/search?client=ubuntu&channel=fs&q=maxmind+kansas+farm&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=max...

maslam 8y ago

> To aid reproducibility, we open source our entire approach. Where the code? :/

alam2000 8y ago

Who is the Provider A and Provider B in Figure 7? IP2Location and Maxmind?

coderholic 8y ago

We use rdns hostname data as one of the data sources for our geolocation database at https://ipinfo.io https://ipinfo.io, but some of the ML stuff here is definitely interesting, and we'll be looking integrating some of the more novel techniques covered here!