|
Re: Location of IP address ???
You can pin someone down to an Internet Service Provider through their IP, which in most circumstances, will also give you the city in which they live and their connection type. It can sometimes help to do an "explorative reverse resolution". At the command prompt, type nslookup <ip or hostname>
For example:
C:\Documents and Settings\syphus>nslookup itsallpc.co.uk
Server: curo.vanadiumax.local
Address: 192.168.0.1
Non-authoritative answer:
Name: itsallpc.co.uk
Address: 213.171.218.201
C:\Documents and Settings\syphus>nslookup 213.171.218.201
Server: curo.vanadiumax.local
Address: 192.168.0.1
Name: server218-apache201.livedns.org.uk
Address: 213.171.218.201
As you can see here, the IP the domain itsallpc.co.uk resolves to, reverse resolves to a different hostname. This is because the host has a managing DNS (domain name server), and does not handle its own resolution requests; in this case it appears to be livedns.org.uk that's handling the domain. It gives us a good clue about the construction of the network.
It's not possible to resolve the user's location any further than that with the IP alone.
The easiest way to extract the ISP from an IP is to read the hostname which the IP reverse resolves to. If the hostname doesn’t make any sense to you, or the IP has a domain of its own, you can try a route trace. A route trace sends a series of a special type of packet called an ICMP (Internet Control Message Protocol) echo, each with an incrementing TTL (Time to Live) value. The TTL value is decreased by each router as it passes the pack to the next in the chain to the remote host, until it reaches 0, in which case the router reports. This continues until the destination IP reports, or until a firewall blocks the ICMP echos.
At the command prompt, type tracert <ip or hostname>
For example:
C:\Documents and Settings\syphus>tracert 213.171.218.201
Tracing route to server218-apache201.livedns.org.uk [213.171.218.201]
over a maximum of 30 hops:
1 1 ms 1 ms 1 ms curo.vanadiumax.local [192.168.0.1] <-- router out of my network
2 277 ms 103 ms 308 ms X [X.X.X.X]
3 399 ms 132 ms 146 ms X [X.X.X.X]
4 138 ms 141 ms 130 ms X
5 495 ms 299 ms 259 ms X [X.X.X.X]
6 312 ms 298 ms 301 ms po0-2.gw1.lax1.asianetcom.net [202.147.61.137] <-- Asia
7 274 ms 272 ms 279 ms ge-6-24.car3.LosAngeles1.Level3.net [4.78.192.53] <-- USA
8 * 270 ms 273 ms ae-1-52.bbr2.LosAngeles1.Level3.net [4.68.102.33]
9 * 406 ms 401 ms as-0-0.bbr1.London1.Level3.net [4.68.128.109] <-- London
10 402 ms 431 ms 403 ms ae-0-11.gar1.london1.level3.net [212.187.131.16]
11 449 ms 402 ms 408 ms 195.50.91.2
12 454 ms 463 ms 451 ms azt-tele1-pos.telewest.net [194.117.136.1] <-- ISP
13 456 ms 453 ms 449 ms 195.188.230.41
14 416 ms 418 ms 417 ms 195.188.230.74
15 * * * Request timed out. <-- Firewall
16 * * 195.188.230.74 reports: Destination net unreachable.
Trace complete.
As you can see, it involves a lot of educated guess work. The first IP is the router at the head of my own network, which has the LAN IP 192.168.0.1. After that I've replaced the next few hostnames and IPs with Xs, since they give a direct route to me, which I'd rather not broadcast :P Following that, we can see the route enters an Asian node, then the US, and into London. After that, things get a bit shadowy, but we can tell that itsallpc.co.uk's connection is provided by the ISP telewest.net at some point. After that, it enters another network, probably a reseller and finally hits a firewall. It’s hard to conclude much from that, except that the IP is in England, probably somewhere near the capitol, although not necessarily inside it. We can tell that the server does not manage its own NS request, which probably means it’s hosted by someone else. This information is enough at least for us to realise that there’s no human being at the end anyway, but we know who the root ISP is and who’s managing the NS requests. Not bad for just the IP alone.
Thats as far as I'm going to take it.
This is all perfectly legal, and does not constitute any breach of privacy because you're using the internet's own architecture to obtain information. It is however considered to be bad etiquette; rather like following someone home and peeking in their windows. Don’t be surprised to find firewalls and understand that all such tests are logged.
|