4 ms·

Reminds me of `echo $(dig @ns1.google.com o-o.myaddr.l.google.com TXT +short | tr -d \")`. I have no idea where this DNS query came from, because searching all

Reminds me of `echo $(dig @ns1.google.com o-o.myaddr.l.google.com TXT +short | tr -d \")`. I have no idea where this DNS query came from, because searching all of Google turns up nothing but https://github.com/GoogleCloudPlatform/cloud-self-test-kit/blob/master/tracerouter.py#L169 https://github.com/GoogleCloudPlatform/cloud-self-test-kit/b..., which is never referenced by anyone. I had to track it down myself for a bootstrap.sh, but I don't like using undocumented sources for critical infrastructure. My use case was needing to set the result of `hostname -f` in /etc/hosts in an automated fashion if a VPS provider didn't already add a line for the public Internet address in that file. You need to do this so that sendmail doesn't fail on `apt install` when it attempts to read your FQDN. So I couldn't use the NGINX example posted elsewhere here. It seems like https://checkip.amazonaws.com/ https://checkip.amazonaws.com/ is much more "reliable" in that it is publicly documented at https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/security-groups.html https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/s.... To anyone who needs to read this: please don't use "services" like icanhazip for your provisioning. Even my examples above are bad. It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. Edit: Oh goodness... even Amazon's documentation recommends using Google's undocumented DNS query.[1] [1]: https://aws.amazon.com/premiumsupport/knowledge-center/route-53-find-ecs-support-dns-resolver/ https://aws.amazon.com/premiumsupport/knowledge-center/route...

quesera 5y ago
> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. It is not possible to know your public IP address, except by fetching the information from a known entity on the public network. And in some scenarios, your public IP will change frequently. There is no guarantee that it will be consistent across multiple requests.
- andrewmcwatters 5y ago
  Yes it is? I'm not talking about a situation where you send a packet to a DHCP server with 0.0.0.0 in the headers, I'm talking about what happens after the fact. Once you have been allocated an IP address, there should be a way to fetch said address. That's the whole mechanism behind forging UDP packets. If I didn't know what my source IP address was, it would be OK to send 0.0.0.0 out into the world all the time. Practically speaking, today, it is, considering most, but not all, ISPs won't let you do this and they will rewrite UDP packets that attempt to forge their source. Edit: OK, since I'm not being clear, let me be explicit: There should be a mechanism in DHCP which allows for the querying of your public Internet address when receiving a packet from a client in one of the Private-Use Networks as defined in RFC 6890. This query should be exposed as a feature of ifconfig or ip, lest a user be forced to manually write such a packet to receive the data.
  - cowsandmilk 5y ago
    > Once you have been allocated an IP address Well, there’s assumption 1 that isn’t true, often, you aren’t allocated a public IP address…at least in IPv4 world
  - viraptor 5y ago
    > querying of your public Internet address Upnp allows you to do that. But that relies on a lot of assumptions. Your address when connecting to X and Y could be different. It could be different depending on the port. It could be load-balanced and come randomly from a pool. It could vary depending on time of day. And many many other cases.
  - fierro 5y ago
    you could be behind NAT or reverse proxies or any number of virtual or physical network components. This service helps account for all of that.
  - lmm 5y ago
    Private-use networks connected to the public internet are an ugly hack. If you don't have a public address, you don't have a public address in any meaningful sense, so any effort to figure out "your" address is doomed from the start. Particularly in these days of IPv6, just give everything a notionally publicly routable address and then every device can know its real address (of course this doesn't have to mean you actually route public traffic to every address if you don't want to).
  - numpad0 5y ago
    I guess you can pick an empty or safe spot from here[1] and send patches to major DHCP server implementations, feels like option 81 "Client FQDN" is already close to that though. Also do keep in mind that an OS instance can have multiple Ethernet interfaces, and that each interface can have multiple IPs, and that not all DHCP gives out private addresses(University Wi-Fi gave me 133.xx back in the days ... behind NAT!), and that double NAT exists. 1: https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml https://www.iana.org/assignments/bootp-dhcp-parameters/bootp...
  - 5y ago
- rkeene2 5y ago
  This is why running this (completely trivial) service yourself is helpful -- you can get the external IP from the perspective you desire.
  - quesera 5y ago
    Indeed. I like to include two convenience endpoints in my webserver configs (except in cases where I'd need to justify them to compliance/audit, etc): * /ip responds with the src ip of the request * /req responds with the full headers and body of the request The latter is useful for debugging HTTP clients.
Jasper_ 5y ago
> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. There is no singular thing called a "public Internet address". Imagine you're writing paper letters to someone. You write a letter, you put your own From address, you drop it in the slot. When the mailperson comes to collect the letter, they replace your mailing address with a special other codeword. And when they receive mail, they replace that codeword back with your original address. You would never know it was intercepted unless you asked around. There's no official protocol to ask for your codeword, it's just a trick the mail service does on your behalf. Your home router does exactly this; it's known as "Network Address Translation", or NAT. It's not an official part of IPv4, and there's no protocol to ask what it is. Your computer thinks its local IP address (typically some variety of 192.168.0.1) is its real, public address, and your router does the swap behind your back.
- tialaramex 5y ago
  > There is no singular thing called a "public Internet address". There sort of is, it just doesn't help answer the question. Both types of addresses have blocks explicitly carved out which are not unicast addresses to be routed over the public Internet. If you have one of those addresses, such as 192.168.0.1, that definitely isn't your "public Internet address" because people can't route stuff to it.
- andrewmcwatters 5y ago
  This is explicitly wrong. There absolutely is such a thing as a "public Internet" address, which is the exact terminology used by the IETF. NAT isn't a part of the Internet Protocol, but it is well-defined in other related RFCs.
  - Jasper_ 5y ago
    Yes, I know about what the IETF considers a "public Internet address", but it's sort of ill-defined for a lot of standard network topologies. NAT is a technique, not an explicit protocol. The RFCs simply cover the technique as it existed in practice.
- 5y ago
gnopgnip 5y ago
dig myip.opendns.com resolver1.opendns.com is another option
fulafel 5y ago
> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. Because traditionally if you're doing things right, you're not using NAT, which is against IP specs and a nonstandard kludge. So you just take your socket and query its local endpoint address using getsockname and voila.
luckman212 5y ago
Why the extra `echo` and subshell $(...) ? dig... | tr... works fine without it. also, `dig -4 ... ` to get your IPv4 address, for us dual-stacked folks. Otherwise it returns your V6 address by default.
- andrewmcwatters 5y ago
  Yes, I pulled it out of a shell script which had more concatenated to it and didn’t bother cleaning it up.
thatjamesdude 5y ago
What kind of documentation would you like to see for a service like this? Genuinely asking because I've always used the query dig +short myip.opendns.com @resolver1.opendns.com to resolve the public IP my ISP has assigned me so I can update my homelab's IP. I use Route53 and I either completely missed the checkip link or they simply don't mention it

quesera 5y ago

> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. It is not possible to know your public IP address, except by fetching the information from a known entity on the public network. And in some scenarios, your public IP will change frequently. There is no guarantee that it will be consistent across multiple requests.

andrewmcwatters 5y ago
Yes it is? I'm not talking about a situation where you send a packet to a DHCP server with 0.0.0.0 in the headers, I'm talking about what happens after the fact. Once you have been allocated an IP address, there should be a way to fetch said address. That's the whole mechanism behind forging UDP packets. If I didn't know what my source IP address was, it would be OK to send 0.0.0.0 out into the world all the time. Practically speaking, today, it is, considering most, but not all, ISPs won't let you do this and they will rewrite UDP packets that attempt to forge their source. Edit: OK, since I'm not being clear, let me be explicit: There should be a mechanism in DHCP which allows for the querying of your public Internet address when receiving a packet from a client in one of the Private-Use Networks as defined in RFC 6890. This query should be exposed as a feature of ifconfig or ip, lest a user be forced to manually write such a packet to receive the data.
- cowsandmilk 5y ago
  > Once you have been allocated an IP address Well, there’s assumption 1 that isn’t true, often, you aren’t allocated a public IP address…at least in IPv4 world
- viraptor 5y ago
  > querying of your public Internet address Upnp allows you to do that. But that relies on a lot of assumptions. Your address when connecting to X and Y could be different. It could be different depending on the port. It could be load-balanced and come randomly from a pool. It could vary depending on time of day. And many many other cases.
- fierro 5y ago
  you could be behind NAT or reverse proxies or any number of virtual or physical network components. This service helps account for all of that.
- lmm 5y ago
  Private-use networks connected to the public internet are an ugly hack. If you don't have a public address, you don't have a public address in any meaningful sense, so any effort to figure out "your" address is doomed from the start. Particularly in these days of IPv6, just give everything a notionally publicly routable address and then every device can know its real address (of course this doesn't have to mean you actually route public traffic to every address if you don't want to).
- numpad0 5y ago
  I guess you can pick an empty or safe spot from here[1] and send patches to major DHCP server implementations, feels like option 81 "Client FQDN" is already close to that though. Also do keep in mind that an OS instance can have multiple Ethernet interfaces, and that each interface can have multiple IPs, and that not all DHCP gives out private addresses(University Wi-Fi gave me 133.xx back in the days ... behind NAT!), and that double NAT exists. 1: https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml https://www.iana.org/assignments/bootp-dhcp-parameters/bootp...
- 5y ago
rkeene2 5y ago
This is why running this (completely trivial) service yourself is helpful -- you can get the external IP from the perspective you desire.
- quesera 5y ago
  Indeed. I like to include two convenience endpoints in my webserver configs (except in cases where I'd need to justify them to compliance/audit, etc): * /ip responds with the src ip of the request * /req responds with the full headers and body of the request The latter is useful for debugging HTTP clients.

Jasper_ 5y ago

> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. There is no singular thing called a "public Internet address". Imagine you're writing paper letters to someone. You write a letter, you put your own From address, you drop it in the slot. When the mailperson comes to collect the letter, they replace your mailing address with a special other codeword. And when they receive mail, they replace that codeword back with your original address. You would never know it was intercepted unless you asked around. There's no official protocol to ask for your codeword, it's just a trick the mail service does on your behalf. Your home router does exactly this; it's known as "Network Address Translation", or NAT. It's not an official part of IPv4, and there's no protocol to ask what it is. Your computer thinks its local IP address (typically some variety of 192.168.0.1) is its real, public address, and your router does the swap behind your back.

tialaramex 5y ago
> There is no singular thing called a "public Internet address". There sort of is, it just doesn't help answer the question. Both types of addresses have blocks explicitly carved out which are not unicast addresses to be routed over the public Internet. If you have one of those addresses, such as 192.168.0.1, that definitely isn't your "public Internet address" because people can't route stuff to it.
andrewmcwatters 5y ago
This is explicitly wrong. There absolutely is such a thing as a "public Internet" address, which is the exact terminology used by the IETF. NAT isn't a part of the Internet Protocol, but it is well-defined in other related RFCs.
- Jasper_ 5y ago
  Yes, I know about what the IETF considers a "public Internet address", but it's sort of ill-defined for a lot of standard network topologies. NAT is a technique, not an explicit protocol. The RFCs simply cover the technique as it existed in practice.
5y ago

gnopgnip 5y ago

dig myip.opendns.com resolver1.opendns.com is another option

fulafel 5y ago

> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. Because traditionally if you're doing things right, you're not using NAT, which is against IP specs and a nonstandard kludge. So you just take your socket and query its local endpoint address using getsockname and voila.

luckman212 5y ago

Why the extra `echo` and subshell $(...) ? dig... | tr... works fine without it. also, `dig -4 ... ` to get your IPv4 address, for us dual-stacked folks. Otherwise it returns your V6 address by default.

andrewmcwatters 5y ago
Yes, I pulled it out of a shell script which had more concatenated to it and didn’t bother cleaning it up.

thatjamesdude 5y ago

What kind of documentation would you like to see for a service like this? Genuinely asking because I've always used the query dig +short myip.opendns.com @resolver1.opendns.com to resolve the public IP my ISP has assigned me so I can update my homelab's IP. I use Route53 and I either completely missed the checkip link or they simply don't mention it