It isn’t CSI magic—it’s easy to get location info from an IP address. The internet is split up into chunks, called subnets, which are spread around the globe. Getting a location is as simple as finding which subnet an IP falls into.
How Does This Work, Anyway?
Subnets are defined by CIDR notation, which is just a concise way of representing a range of IP addresses. For example, 192.168.1.0/24 represents the range from 192.168.1.0 to 192.168.1.255. The number following the slash indicates how many bits are used for the address (in this case, the first 24 bits, which make up the first 3 bytes) and the rest are given to be allocated to devices (in this case, the final 8 bits, making up the last number in the address).
The largest chunks are allocated by the Internet Assigned Numbers Authority (IANA). IANA is in charge of allocating the first number of an IP address, from 0.XXX.XXX.XXX to 255.XXX.XXX.XXX. Allocation of addresses in those blocks are given to more local agencies.
For example, the IP address 173.79.255.255 is part of the 173.0.0.0/8 block, which was given to the American Registry for Internet Numbers (ARIN) in 2008. Within that block, 173.64 through 173.79 was allocated to Verizon for use in the northern Virginia area, which is where our example IP address falls.
You won’t be able to track someone to their house like they do in the movies, but you can easily get city/region information. All of this is public and online, and you can check your own address using ARIN’s search tools.
So the only real thing you have to do to get location information from an IP address is have a table of all the different allocations that IANA, ARIN, and others have made; then, you could simply search the table like any other database.
The info is all publically available, so if you want to search for it yourself on ARIN’s website, you can, but there are people who have already compiled IP-Location databases and made the process much easier.
Consult an IP-Location Database
There are plenty of these online, with many of them being completely free. KeyCDN runs a free lookup tool, complete with an API that you can access it from. Simply type the IP address in, and it will show you all the information it has.
Having access to this info from an API is particularly useful when you want to find a location programmatically. For example, if you want to check the location of problematic IPs hitting your server, you could grab the IP address from the log files and run it by an API. If it’s foreign, or coming from a strange place, it may be malicious.
You can access KeyCDN’s API from the following URL, with a utility like curl:
curl https://tools.keycdn.com/geo.json?host=173.79.254.254
Or from a programming language like PHP:
$IP = ‘173.79.254.254’;
$json = file_get_contents(‘https://tools.keycdn.com/geo.json?host=’ . $IP);
$obj = json_decode($json);
This particular API returns a JSON object with the information. For instance, you could find the ZIP code of an address with response.data.geo.postal_code:
{
“status”: “success”,
“description”: “Data successfully received.”,
“data”: {
“geo”: {
“host”: “173.79.254.254”,
“ip”: “173.79.254.254”,
“rdns”: “pool-173-79-254-254.washdc.fios.verizon.net”,
“asn”: 701,
“isp”: “MCI Communications Services, Inc. d/b/a Verizon Business”,
“country_name”: “United States”,
“country_code”: “US”,
“region_name”: “Virginia”,
“region_code”: “VA”,
“city”: “Alexandria”,
“postal_code”: “22309”,
“continent_name”: “North America”,
“continent_code”: “NA”,
“latitude”: 38.719,
“longitude”: -77.1067,
“metro_code”: 511,
“timezone”: “America/New_York”,
“datetime”: “2019-08-22 17:30:48”
}
}
}
The API is rate limited to three requests per second, which should be fine for normal use.
If you want to make a lot of requests very quickly, you’ll need your own database. These are publically available as well; IP2Location offers a “Lite” version of their database for free, though you can also buy a table with more accurate entries. This comes in the form of a CSV, which you can easily load into MySQL or another database solution and access programmatically.