hloc: hints-based geolocation leveraging multiple ......geolocating ip addresses geolocation...
TRANSCRIPT
![Page 1: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/1.jpg)
Chair of Network Architectures and ServicesDepartment of InformaticsTechnical University of Munich
HLOC: Hints-Based Geolocation Leveraging MultipleMeasurement Frameworks
Quirin Scheitle, Oliver Gasser, Patrick Sattler, Georg Carle
TMA’17, DublinJune 22, 2017
Chair of Network Architectures and ServicesDepartment of Informatics
Technical University of Munich
![Page 2: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/2.jpg)
Geolocating IP Addresses
Geolocation focuses:
• Human-centric, e.g. for businesses• Structural mapping, e.g. of Internet routers
Geolocation approaches:
• Commercial databases• Measurement-based algorithms
Our goals:
• Combine ease-of-use of databases with accuracy of measurement-based approaches• Focus on Internet routers
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 2
![Page 3: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/3.jpg)
Geolocating IP Addresses
Geolocation focuses:
• Human-centric, e.g. for businesses• Structural mapping, e.g. of Internet routers
Geolocation approaches:
• Commercial databases• Measurement-based algorithms
Our goals:
• Combine ease-of-use of databases with accuracy of measurement-based approaches• Focus on Internet routers
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 2
![Page 4: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/4.jpg)
Related Work
Measurement-based:
• Large body of related work using latency, TTL, link-level topology, etc.for geolocation [6, 11, 12, 8, 4, 14, 13, 5, 9, 1]
• High barrier of entry through complex setup and calibration phase
DNS-based:
• RFC 1876: Store latitude and longitude in DNS [2]→ rarely used• DRoP [7]: Good results for ground-truth domains, no ready-to-use solution
Database-based:
• Questionable accuracy of geolocation databases [3, 10]
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 3
![Page 5: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/5.jpg)
HLOC
• Geolocation based on hints in domain names• Validation of geolocation hints using latency measurements• Multi-level measurements
• High-bandwidth scans• Globally distributed scans using RIPE Atlas
• Accuracy of dozens to hundreds of km→ country-level• Ready-to-use
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 4
![Page 6: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/6.jpg)
Approach
Parse Codes
GeoNames
Locode,CLLI
IATA, ICAO, FAA muc,
munic,muenchen,
dub,dublin
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 5
![Page 7: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/7.jpg)
Approach
Parse Codes Preprocess Domains
GeoNames
Locode,CLLI
rDNS Data
IATA, ICAO, FAA
104.129.72.194.lightower.netxe2-0-2-0-grtfraix4.ip6.tiws.net
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 5
![Page 8: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/8.jpg)
Approach
Parse Codes Preprocess Domains
Search Codes in Domains
GeoNames
Locode,CLLI
rDNS Data
Blacklists
IATA, ICAO, FAA
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 5
![Page 9: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/9.jpg)
Approach
Parse Codes Preprocess Domains
Search Codes in Domains
Measure Latencyto Hints
GeoNames
Locode,CLLI
rDNS Data
Blacklists
Ripe Atlas
Probe API
ZMap
...
IATA, ICAO, FAA
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 5
![Page 10: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/10.jpg)
Approach
Parse Codes Preprocess Domains
Search Codes in Domains
Measure Latencyto Hints
Validate Hints
GeoNames
Locode,CLLI
rDNS Data
Blacklists
Ripe Atlas
Probe API
ZMap
...
IATA, ICAO, FAA
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 5
![Page 11: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/11.jpg)
Challenges
• Fast search of location hints in domains→ Trie• Reduce number of unlikely matches→ Blacklisting• Tailor to measurement limits→ Use multiple frameworks
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 6
![Page 12: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/12.jpg)
Challenges
• Fast search of location hints in domains→ Trie• Reduce number of unlikely matches → Blacklisting• Tailor to measurement limits → Use multiple frameworks
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 6
![Page 13: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/13.jpg)
Fast Hint Search: Trie
root
dubmuc ...
→ Very fast lookup
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 7
![Page 14: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/14.jpg)
Fast Hint Search: Trie
root
dublin dubai ...
dubmuc ...
→ Very fast lookup
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 7
![Page 15: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/15.jpg)
Fast Hint Search: Trie
root
dublin
dublinidublinadublino dubaija ...
dubai ...
dubmuc ...
→ Very fast lookup
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 7
![Page 16: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/16.jpg)
Fast Hint Search: Trie
root
dublin
dublinidublinadublino dubaija ...
dubai ...
dubmuc ...
→ Very fast lookup
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 7
![Page 17: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/17.jpg)
Reduce Unlikely Matches: Blacklisting
Certain words in domains do not include a location
• Unnecessary increase of measurement duration
Example:ae-0..amstnl02.nl.bb.gin.ntt.net
• ams (IATA): Amsterdam, Netherlands (2.3 ms)• face (ICAO): Ceres, South Africa• ace (IATA): Lanzarote, Spain• ceb (IATA): Lapu-Lapu City, Philippines• . . .
Publicly available blacklists on Github
• Crowdsourcing blacklists further improves measurement performance
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 8
![Page 18: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/18.jpg)
Reduce Unlikely Matches: Blacklisting
Certain words in domains do not include a location
• Unnecessary increase of measurement duration
Example:ae-0.facebook.amstnl02.nl.bb.gin.ntt.net
• ams (IATA): Amsterdam, Netherlands (2.3 ms)• face (ICAO): Ceres, South Africa• ace (IATA): Lanzarote, Spain• ceb (IATA): Lapu-Lapu City, Philippines• . . .
Publicly available blacklists on Github
• Crowdsourcing blacklists further improves measurement performance
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 8
![Page 19: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/19.jpg)
Reduce Unlikely Matches: Blacklisting
Certain words in domains do not include a location
• Unnecessary increase of measurement duration
Example:ae-0.facebook.amstnl02.nl.bb.gin.ntt.net
• ams (IATA): Amsterdam, Netherlands (2.3 ms)• face (ICAO): Ceres, South Africa• ace (IATA): Lanzarote, Spain• ceb (IATA): Lapu-Lapu City, Philippines• . . .
Publicly available blacklists on Github
• Crowdsourcing blacklists further improves measurement performance
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 8
![Page 20: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/20.jpg)
Reduce Unlikely Matches: Blacklisting
Certain words in domains do not include a location
• Unnecessary increase of measurement duration
Example:ae-0.facebook.amstnl02.nl.bb.gin.ntt.net
• ams (IATA): Amsterdam, Netherlands (2.3 ms)• face (ICAO): Ceres, South Africa• ace (IATA): Lanzarote, Spain• ceb (IATA): Lapu-Lapu City, Philippines• . . .
Publicly available blacklists on Github
• Crowdsourcing blacklists further improves measurement performance
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 8
![Page 21: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/21.jpg)
Reduce Unlikely Matches: Blacklisting
Certain words in domains do not include a location
• Unnecessary increase of measurement duration
Example:ae-0.facebook.amstnl02.nl.bb.gin.ntt.net
• ams (IATA): Amsterdam, Netherlands (2.3 ms)• face (ICAO): Ceres, South Africa• ace (IATA): Lanzarote, Spain• ceb (IATA): Lapu-Lapu City, Philippines• . . .
Publicly available blacklists on Github
• Crowdsourcing blacklists further improves measurement performance
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 8
![Page 22: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/22.jpg)
Use Multiple Measurement Frameworks
Limitations in frameworks
• Parallel running measurements• Requests per second
Multi-level approach
1. Measure from high bandwidth servers in few locations• Pin-point hemisphere of location• e.g., dedicated servers with ZMap
2. Measure from low bandwidth probes in many locations• Measurement close to hinted location• e.g., RIPE Atlas
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 9
![Page 23: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/23.jpg)
Use Multiple Measurement Frameworks
Limitations in frameworks
• Parallel running measurements• Requests per second
Multi-level approach
1. Measure from high bandwidth servers in few locations• Pin-point hemisphere of location• e.g., dedicated servers with ZMap
2. Measure from low bandwidth probes in many locations• Measurement close to hinted location• e.g., RIPE Atlas
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 9
![Page 24: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/24.jpg)
Use Multiple Measurement Frameworks
Limitations in frameworks
• Parallel running measurements• Requests per second
Multi-level approach
1. Measure from high bandwidth servers in few locations• Pin-point hemisphere of location• e.g., dedicated servers with ZMap
2. Measure from low bandwidth probes in many locations• Measurement close to hinted location• e.g., RIPE Atlas
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 9
![Page 25: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/25.jpg)
Validation Concept
• Pick possible location match from right to left label• Pick suitable probe dist(probe, location) < x
• Check validation threshold:
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(1)
• a is the maximal buffer time• c · c0 is the propagation speed in fiber optics
• If fulfilled, stop else repeat for the other location matches• Our maximum error margin is 2900 km (a = 9ms; x = 1000km)
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 10
![Page 26: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/26.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 27: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/27.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA
• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 28: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/28.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 29: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/29.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA• anx (IATA): Andenes, Norway
• Select probe near suspected location
• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 30: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/30.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 31: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/31.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe
• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 32: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/32.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 33: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/33.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints
• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 34: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/34.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints
• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 35: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/35.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 36: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/36.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
RTT (probe, host) < a +2 · dist(probe, location)
c · c0(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 37: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/37.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
1.3ms < 9ms +2 · 0.84km
200 kmms
(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 38: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/38.jpg)
Measurement Example
• cr-01.0v-00-04.anx32.nyc.us.anexia-it.com
• nyc (IATA): New York City, USA→ 1.3 ms• anx (IATA): Andenes, Norway
• Select probe near suspected location• New York (Probe ID: 17736; distance: 0.84 km)
• Measure RTT from probe• RTT(Probe(17736), "2001:2000:3080:c44::2") = 1.3 ms
• Eliminate impossible hints• Validate RTT measurements using threshold
1.3ms < 9ms +2 · 0.84km
200 kmms
(2)
• Location confirmed X
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 11
![Page 39: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/39.jpg)
Large-scale Measurements
• Conducted large-scale measurements to geolocate IPv4 and IPv6 routers
# IP addresses IPv4 IPv6
Routers 2.5M 190k– No Match –1.0M –7.2k– Timeout –431k –151k
Responsive 961k (100%) 29k (100%)All hints falsified 417k (43.4%) 7k (22.9%)Hint verified 45k (4.7%) 5k (17.6%)No hint verified 500k (52.0%) 17k (59.5%)
• Many falsified hints• About 50k verified hints
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 12
![Page 40: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/40.jpg)
Large-scale Measurements
• Conducted large-scale measurements to geolocate IPv4 and IPv6 routers
# IP addresses IPv4 IPv6
Routers 2.5M 190k– No Match –1.0M –7.2k– Timeout –431k –151k
Responsive 961k (100%) 29k (100%)All hints falsified 417k (43.4%) 7k (22.9%)Hint verified 45k (4.7%) 5k (17.6%)No hint verified 500k (52.0%) 17k (59.5%)
• Many falsified hints• About 50k verified hints
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 12
![Page 41: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/41.jpg)
Large-scale Measurements
• Conducted large-scale measurements to geolocate IPv4 and IPv6 routers
# IP addresses IPv4 IPv6
Routers 2.5M 190k– No Match –1.0M –7.2k– Timeout –431k –151k
Responsive 961k (100%) 29k (100%)All hints falsified 417k (43.4%) 7k (22.9%)Hint verified 45k (4.7%) 5k (17.6%)No hint verified 500k (52.0%) 17k (59.5%)
• Many falsified hints
• About 50k verified hints
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 12
![Page 42: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/42.jpg)
Large-scale Measurements
• Conducted large-scale measurements to geolocate IPv4 and IPv6 routers
# IP addresses IPv4 IPv6
Routers 2.5M 190k– No Match –1.0M –7.2k– Timeout –431k –151k
Responsive 961k (100%) 29k (100%)All hints falsified 417k (43.4%) 7k (22.9%)Hint verified 45k (4.7%) 5k (17.6%)No hint verified 500k (52.0%) 17k (59.5%)
• Many falsified hints• About 50k verified hints
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 12
![Page 43: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/43.jpg)
RIPE Atlas Probe Coverage
© Google Maps
• Good coverage of Europe and USA• Less coverage in Asia, Africa, and some parts of South America
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 13
![Page 44: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/44.jpg)
RIPE Atlas Probe Coverage
© Google Maps
• Good coverage of Europe and USA• Less coverage in Asia, Africa, and some parts of South America
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 13
![Page 45: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/45.jpg)
IPv4 Locations of Validated Domains
© Google Maps
• Similar coverage as RIPE Atlas probes
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 14
![Page 46: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/46.jpg)
IPv4 Locations of Validated Domains
© Google Maps
• Similar coverage as RIPE Atlas probes
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 14
![Page 47: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/47.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP
• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 48: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/48.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 49: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/49.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:
• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 50: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/50.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 51: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/51.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:
• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 52: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/52.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 53: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/53.jpg)
DRoP Comparison
• Goal: Compare our results with DRoP• Reproduce the hint generator using DRoP rules• Evaluation on DRoP ground truth domains
• cogentco.com:• 26% validated DRoP hints• 7% falsified DRoP hints
• ntt.net:• DRoP claims 96% of domains with location hint• Reproduction has 54% — HLOC 99%• NTT uses custom CLLI location hints (e.g., londen)
• xe2-0-2-0-grtfraix4.ip6.tiws.net
• Validated in Frankfurt using HLOC• Complex pattern where DRoP would not match
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 15
![Page 54: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/54.jpg)
Commercial Database Comparison
• How well do commercial databases work on geolocating routers?
Same Possible Wrong No Data
GeoLite 40.4% 15.6% 44% -ip2location 76.6% 11.3% 12.1% -DRoP 7.8% 0.1% 8.4% 83.7%
• Falsified almost half of locations by most popular geolocation database
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 16
![Page 55: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/55.jpg)
Commercial Database Comparison
• How well do commercial databases work on geolocating routers?
Same Possible Wrong No Data
GeoLite 40.4% 15.6% 44% -ip2location 76.6% 11.3% 12.1% -DRoP 7.8% 0.1% 8.4% 83.7%
• Falsified almost half of locations by most popular geolocation database
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 16
![Page 56: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/56.jpg)
Commercial Database Comparison
• How well do commercial databases work on geolocating routers?
Same Possible Wrong No Data
GeoLite 40.4% 15.6% 44% -ip2location 76.6% 11.3% 12.1% -DRoP 7.8% 0.1% 8.4% 83.7%
• Falsified almost half of locations by most popular geolocation database
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 16
![Page 57: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/57.jpg)
Result Summary and Next Steps
• Summarized
• HLOC finds more locations by leveraging complex pattern matching• Commercial databases perform poorly on routers• IP-encoded domain names contain less locations
• Coming up• Improved probe selection• Direct integration into RIPE Atlas• Web service to geolocate hosts• Integration of additional measurement frameworks (e.g. ProbeAPI)
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 17
![Page 58: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/58.jpg)
Result Summary and Next Steps
• Summarized• HLOC finds more locations by leveraging complex pattern matching• Commercial databases perform poorly on routers• IP-encoded domain names contain less locations
• Coming up• Improved probe selection• Direct integration into RIPE Atlas• Web service to geolocate hosts• Integration of additional measurement frameworks (e.g. ProbeAPI)
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 17
![Page 59: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/59.jpg)
Result Summary and Next Steps
• Summarized• HLOC finds more locations by leveraging complex pattern matching• Commercial databases perform poorly on routers• IP-encoded domain names contain less locations
• Coming up
• Improved probe selection• Direct integration into RIPE Atlas• Web service to geolocate hosts• Integration of additional measurement frameworks (e.g. ProbeAPI)
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 17
![Page 60: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/60.jpg)
Result Summary and Next Steps
• Summarized• HLOC finds more locations by leveraging complex pattern matching• Commercial databases perform poorly on routers• IP-encoded domain names contain less locations
• Coming up• Improved probe selection• Direct integration into RIPE Atlas• Web service to geolocate hosts• Integration of additional measurement frameworks (e.g. ProbeAPI)
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 17
![Page 61: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/61.jpg)
Key Contributions
• Geolocation focused on routers• Multi-level measurement framework• Configurable accuracy and error margins• Source code and data available
Questions?
Source code, blacklist, and data set: https://github.com/tumi8/hloc
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 18
![Page 62: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/62.jpg)
Key Contributions
• Geolocation focused on routers• Multi-level measurement framework• Configurable accuracy and error margins• Source code and data available
Questions?
Source code, blacklist, and data set: https://github.com/tumi8/hloc
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 18
![Page 63: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/63.jpg)
Bibliography
[1] M. Calder, X. Fan, Z. Hu, E. Katz-Bassett, J. Heidemann, and R. Govindan.Mapping the expansion of Google’s serving infrastructure.In ACM SIGCOMM Conference on Internet Measurement, 2013.
[2] C. Davis, P. Vixie, T. Goodwin, and I. Dickinson.A Means for Expressing Location Information in the Domain Name System.RFC 1876 (Experimental), Jan. 1996.
[3] B. Gueye, S. Uhlig, and S. Fdida.Investigating the Imprecision of IP Block-Based Geolocation.In Passive and Active Measurement, 2007.
[4] B. Gueye, A. Ziviani, M. Crovella, and S. Fdida.Constraint-Based Geolocation of Internet Hosts.IEEE/ACM Transactions On Networking, 2006.
[5] C. Guo, Y. Liu, W. Shen, H. J. Wang, Q. Yu, and Y. Zhang.Mining the Web and the Internet for Accurate IP Address Geolocations.In INFOCOM, 2009.
[6] Z. Hu, J. Heidemann, and Y. Pradkin.Towards Geolocation of Millions of IP Addresses.In ACM SIGCOMM Conference on Internet Measurement, 2012.
[7] B. Huffaker, M. Fomenkov, and k. c. Claffy.DRoP: DNS-Based Router Positioning.ACM SIGCOMM Computer Communication Review, 2014.
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 19
![Page 64: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/64.jpg)
Bibliography
[8] E. Katz-Bassett et al.Towards IP Geolocation Using Delay and Topology Measurements.In ACM SIGCOMM Conference on Internet Measurement, 2006.
[9] V. N. Padmanabhan and L. Subramanian.An Investigation of Geographic Mapping Techniques for Internet Hosts.In ACM SIGCOMM Computer Communication Review. ACM, 2001.
[10] I. Poese, S. Uhlig, M. A. Kaafar, B. Donnet, and B. Gueye.IP Geolocation Databases: Unreliable?ACM SIGCOMM Computer Communication Review, 2011.
[11] Y. Wang, D. Burgener, M. Flores, A. Kuzmanovic, and C. Huang.Towards Street-Level Client-Independent IP Geolocation.In NSDI, 2011.
[12] B. Wong, I. Stoyanov, and E. G. Sirer.Octant: A Comprehensive Framework for the Geolocalization of Internet Hosts.In NSDI, 2007.
[13] K. Yoshida et al.Inferring PoP-level ISP Topology through End-to-End Delay Measurement.In Passive and Active Measurement, 2009.
[14] I. Youn, B. L. Mark, and D. Richards.Statistical Geolocation of Internet Hosts.In International Conference on Computer Communications and Networks. IEEE, 2009.
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 20
![Page 65: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/65.jpg)
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 21
![Page 66: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/66.jpg)
Backup SlidesWhich Code Sources are Valuable?
• Evaluate verified locations based on used location code source
Category IATA ICAO FAA UN/LO GeoNames CLLI
# Codes 8k 13k 20k 77k 32k 31k
Hints 4.5M 209k 472k 59k 215k 167kVerified 32k 122 413 120 13k 5kVerified (%) .7% < .0% .1% < .0% 5.9% 2.8%
• IATA, GeoNames and CLLI provide 99% of verified hints• UN/Locode gives largest number of codes but negligible number of verified locations
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 22
![Page 67: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/67.jpg)
Backup SlidesLocations without RIPE Atlas Probe
© Google Maps
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 23
![Page 68: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/68.jpg)
Backup SlidesIPv6 Locations of Validated Domains
© Google Maps
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 24
![Page 69: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/69.jpg)
Backup SlidesVerified: Error Margin Analysis
0 200 400 600 800 1000 1200 1400
km
0 %
20 %
40 %
60 %
80 %
100 %%
Dom
ain
s [x
< X
]
(1) x = Distance Probe - Hint
(2) a = Latency Buffer Used
(3) Maximum Error (2x+a)
• 80% of distances under 25 km• Used latency buffer and possible error increase linearly
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 25
![Page 70: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/70.jpg)
Backup SlidesNot Verified: Sensitivity Analysis
0 20000 40000 60000 80000 100000
Latency in Excess of 9ms margin [converted to km]
0
20
40
60
80
100%
Dom
ain
s [x
< X
]
IPv4 excessive latency
IPv6 excessive latency
• Excessive latency rises linearly
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 26
![Page 71: HLOC: Hints-Based Geolocation Leveraging Multiple ......Geolocating IP Addresses Geolocation focuses: •Human-centric, e.g. for businesses •Structural mapping, e.g. of Internet](https://reader034.vdocuments.net/reader034/viewer/2022042621/5f5a407ab7b988132b7ef501/html5/thumbnails/71.jpg)
Backup SlidesDomains with Encoded IP Addresses
• Encoded IP addresses in domain name• Point to automatically generated domain names• Assumption: Lower likelihood of included location in domain name• Goal: Find encoded IP addresses in domain names
• Deutsche Telekom domain name• p4FE3C4A8.dip0.t-ipconnect.de
• 79.227.196.168
• Hexadecimally encoded IPv4 address
• Telus IPv6 domain name• node-1w7jr9qi52esshkbkmpnz14yh.ipv6.telus.net
• 2001:569:71d6:2fff:4e8b:30ff:fe48:9e59
• Alphanumerically encoded IPv6 address
• Location match likelihood for IP-encoded domains• IPv4: Twice as low• IPv6: Ten times lower
• Pre-filter IP-encoded domains
Q. Scheitle, O. Gasser, P. Sattler, G. Carle — HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks 27