Identifying IP addresses

May 16, 2006 7:53 PM

I have an IP address and I would like to work out where it is. I know it is on a university network but I would like a more accurate placing of it than that. Can anyone recommend a technique, software or website, which might give me the information? Thanks.
posted by Hermit to Computers & Internet (9 answers total)

Do you mean you're trying to find out which building on that campus the address is being used within, or what?
posted by kimota at 7:59 PM on May 16, 2006

Use nslookup to see if there is a naming scheme tied to campus IP addresses. Not always reliable but you never know. If you use traceroute, generally the host above the IP address itself is the subnet's router. Routers can be tied to a campus-wide naming scheme that invokes the building name or physical location.

If you're in the subnet and router security is poor or non-existent — not always impossible on a university campus — you might use SNMP tools to access the router and find out through which switch your IP traffic is being routed. Switches are hooked up to patch cables to specific ports in rooms. Sometimes you can find out which switch port goes to which outlet in which room.
posted by Mr. Six at 8:02 PM on May 16, 2006

(Mean to hit preview.) The various geographical IP lookups aren't likely to get you anything that granular. Instead, they tend to give information about the IP address space that network uses based on domain registration, so there are times it's useless.

Now, there's some possibility you could do some forensic work to get an idea of that IP's basic whereabouts. Go to samspade.org and enter the IP in the "Do stuff" field. If you're needing to report an act of abuse, you should be able to get the relevant contact info there. Also, the name servers listed, combined with the IP # you've already got, might help give you an idea of how big that network block is. You might be able to do DNS lookups on a random selection or large portion of that and glean some idea of how that network's laid out based on DNS entries, especially if you start looking up information from the university's site, such as its maps or a departments list. I wouldn't expect you to be able to determine room number or floor, but you might be able to get an idea of which dorm room or department the IP is getting used in.
posted by kimota at 8:11 PM on May 16, 2006

Mr. Six's ideas are good, too, although I can see where using net-SNMP or whatever on devices that you don't explicitly have permission to connect to might be frowned upon, to say the least.
posted by kimota at 8:15 PM on May 16, 2006

traceroute/tracert depending on your system may give you information about where your packet bounces around. it also may not. network topology is a bitch unless you have big-picture stuff. Mr. Six's idea would work if you're on their subnet.. could be a big if. I don't think you'll have very good luck once it leaves the last router though. Many, many switches are a lot dumber than the one Mr. Six is talking about :)
posted by devilsbrigade at 9:12 PM on May 16, 2006

On a lot of business and university networks, the reverse DNS entry will let you get a good idea of where an IP is located.
For example, if the reverse was:
2-23.lab.engr.example.edu
Then a good guess would be that the computer in question is in the Engineering lab. You could further extrapolate that it's the port labeled 2-23(usually written in Sharpie on the network jack).
If it were:
4-39.chem.example.edu
Then a good guess would be that it's in the Chemistry building, possibly on the fourth floor, jack 39.

If you have access to the university building, you could look at a few jacks, get a feel for the port numbering convention, and make a good deduction about the location of your IP from that.
posted by madajb at 11:29 PM on May 16, 2006

at my old school there was a table sitting about somewhere on an ftp server that listed the IP ranges for the different buildings, and even maybe parts of buildings. i don't know a) if that university has something similar, b) if it would be public, or c) how to get it, though.
posted by soma lkzx at 6:37 AM on May 17, 2006

Keep in mind that the geographic things can be *very* incorrect, as well. If you're going off of that, then you might not be getting the right information. For instance, my cable modem at home geo's out to being in Kansas. I'm in Texas. That's a thousand mile error.
posted by SpecialK at 8:12 AM on May 17, 2006

Here's what I use to get more information about specific IP adresses:
IP Address Locator
IP2Location.com
posted by Sharcho at 7:26 AM on May 18, 2006