IP Geolocation Through Reverse DNS(arxiv.org)
arxiv.org
IP Geolocation Through Reverse DNS
https://arxiv.org/abs/1811.04288
15 comments
Paper seems to miss to me the obvious approach of not only reverse lookups on the target IP but the last few hops in the trace route to the IP
I have done this, but found that often there are multiple routes available. I haven't figured out an efficient way to filter or index this yet.
That's a neat suggestion to extend this approach. However a key consideration mentioned in the paper was speed and scale. Their approach requires 1 reverse DNS lookup, not running a traceroute to the IP to determine its location
> IP Geolocation databases are widely used in online services to map end user IP addresses to their geographical locations. However, they use proprietary geolocation methods and in some cases they have poor accuracy. We propose a systematic approach to use publicly accessible reverse DNS hostnames for geolocating IP addresses. Our method is designed to be combined with other geolocation data sources. We cast the task as a machine learning problem where for a given hostname, we generate and rank a list of potential location candidates. We evaluate our approach against three state of the art academic baselines and two state of the art commercial IP geolocation databases. We show that our work significantly outperforms the academic baselines, and is complementary and competitive with commercial databases. To aid reproducibility, we open source our entire approach.
(abstract from the linked article)
(abstract from the linked article)
> To aid reproducibility, we open source our entire approach.
Only the approach as how to do it is open sourced or is there an implementation associated with it.
Only the approach as how to do it is open sourced or is there an implementation associated with it.
We use rdns hostname data as one of the data sources for our geolocation database at https://ipinfo.io, but some of the ML stuff here is definitely interesting, and we'll be looking integrating some of the more novel techniques covered here!
Trying to say "we can do IP geolocation through rDNS" is a really bad idea. I control several /16 chunks of IP space that through their ARIN WHOIS entry and rDNS could be located anywhere from northwest montana, to the NW corner of WA state, to Eugene OR, to Boise ID, or anywhere in between.
Maxmind and other geolocation services are also famously bad.
https://www.google.com/search?client=ubuntu&channel=fs&q=max...
Maxmind and other geolocation services are also famously bad.
https://www.google.com/search?client=ubuntu&channel=fs&q=max...
Ideally, a geolocation system should also work in an adversarial setting, when somebody is trying to spoof their geolocation. We recently learned that some VPN providers do that, to appear to have proxies in more countries:
https://research.owlfolio.org/pubs/2018-catch-proxies-lie.pd...
Obviously, people can lie in their reverse DNS record but active measurements from distributed vantage points (e.g., by using the RIPE Atlas network) could expose that.
Obviously, people can lie in their reverse DNS record but active measurements from distributed vantage points (e.g., by using the RIPE Atlas network) could expose that.
Note that you can use https://ipmap.ripe.net to lookup any IP address and RIPE Atlas measurements will be scheduled in the background to figure out the the location. So no need to schedule measurements manually (requiring credits).
We're also working on a reverse DNS geolocating backend BTW. We will look into this paper.
We're also working on a reverse DNS geolocating backend BTW. We will look into this paper.
> To aid reproducibility, we open source our entire approach.
Where the code? :/
Where the code? :/
Reverse DNS typically puts me thousands of miles away. Full stop.
I was hoping for a Proof Of Concept or a Demo...
Is there any implementation yet on how this could be done?
Probably because it's a draft but I was not able to find any source code (looked up the authors github repos and websites)
Also the end of the conclusion is pretty interesting:
> Our future work will focus on combining reverse DNS hostname information with WHOIS databases and network delay to form a geolocation database across the entire IP space