RE: [PHP] IP and countries -- Discussion Continues

On 08-Nov-00 Maxim Maletsky wrote: > Hello, > > Me too, I was always asking this question myself; > > Let's say I have visitor's IP which I add to the database; > In the feature I want to find out where did the guy came from. > > Just resolving it's DNS will give me the domain name which doesn't indicate > the country/continent at all... IP's don't have a location. IP's are assigned to domains (organizations) not to countries. an ip has no location because organizations have no location, just mailing addresses (most of the time). > > No, how can I "ping" his country? you can traceroute the IP and guess at the locations : $ traceroute 202.106.182.3 <snip> // ok still in Austin TX, but on a backbone provider "bbnplanet" // mailing address Cambridge MA 5 s4-1-1.austin2-rc1.bbnplanet.net (4.1.104.205) 115.518 ms 121.188 ms 116.664 ms <snip> // Even money sez we hit their router in Palo Alto CA. 11 p4-0.paloalto-nbr1.bbnplanet.net (4.0.5.65) 185.217 ms 182.769 ms 185.336 ms 12 p1-0.paloalto-cr1.bbnplanet.net (4.0.6.74) 186.304 ms 184.142 ms <snip> // Uh-oh, a bit of a problem no reverse records ... // but the block belongs to "concert.net" who is headquartered in Amsterdam, NL // this suggests one of the Dutch islands 14 166.49.228.36 (166.49.228.36) 173.848 ms 173.450 ms 175.391 ms // Next problem, an un-assigned block. somebody needs a clue-by-four 15 205.174.74.170 (205.174.74.170) 1895.047 ms * * // onto a major provider apnic.net (mail address Queensland AS) 16 202.97.9.65 (202.97.9.65) 2847.795 ms * 2057.407 ms 17 * * * 18 * * * 19 * * * <snip> // looks like our target is gone. either logged off if a dialup, or in this // particular case it's the infamous 'china.com' who blackholed themselves // to keep their server from getting blasted to pieces So if i hadn't said who it was, the last provider was in Austrailia so where is "china.com" server ? > > Is there a good way to find out a country by, maybe, searching whois (or > anything else like whois, nic, apnic, whatever: the question is right here) > for the IP and then knowing the format parse the output with RegEx finding > the country's code. Now logically the country code is the one submitted by > the IP owner as a part of _physical_ address. > Interfaces have a physical address (MAC), it looks like this : 4e:00:01:1e:6d:f5 which has nothing to do with cities or states or countries; but everyting to do with who manufactured the equipment, how many were made, and what the sysadmin had for lunch. IP's don't have a location. Organiztions have IP's, and organazations have mailing addresses but that is as close as you're gonna get. whois pipex.net whois uu.net whois aol.com You get the picture ... > In this way the result could be very precise. > Not in the least, IP's don't have a location. > > > > Is there any simpler way to do what I just tried to explain? traceroute, dig, & whois. > What is the best way to do that? X-Windows > Who did it already? See above > Any services do that? Nope > Any tutorials on this? like riding a bicycle, nobody can "show you how". you have to do it yourself <big'ole snip> (did i mention: IP's don't have a location ?) Regards, -- Don Read dread@texas.net There are old sailors, and there are foolish sailors; but damn few old foolish sailors. ---------------------------------------------