TULIP Trilateration Utility for Locating IP Addresses – A Delay Based Solution for IP Geolocation

Abstract

Currently we see tremendous expansion in the area of network deployment. As companies realized the cost benefits and productivity gains created by network technology, they began to add networks and expand existing networks almost as rapidly as new network technologies and products are being introduced. The problems associated with network expansion affect both day-to-day network operation management and strategic network growth planning. Each new network technology requires its own set of experts. An urgent need has arisen for automated network management (including what is typically called network capacity planning) integrated across diverse environments. In such an increasingly connected world, geo-location of a target host based on its name or address can, for example, provide critical information for security, content delivery and Internet traffic studies. The knowledge of the physical location of a user with an assigned ip address is currently being used from credit card fraud protection to online advertising. However, most industrial use approaches to assign ip-addresses or -ranges to a geolocation are currently based on manually maintained databases which might lead to wrong or outdated information. One cannot assume the location of a host is given by its name (e.g. its Top Level Domain). For example, server hosts associated with a web site may have proxies overseas. While not being useful for all ip addresses (tunnel-endpoints or mobile nodes, for example), most ip addresses can be traced automatically to their location with an inaccuracy of several hundreds of kilometers. This might appear high at first, but judged by the fact that it is e.g. sufficient for credit card fraud protection to know the country the user is currently being located, this is a tolerable inaccuracy. Several examinations developed different mechanisms of automatically geolocation, using a set of servers with known location to triangulate the ip address, using provided location information of the target or topology hints in the router naming scheme. We use delay measurements to dynamically locate a target host, from a set of reference (landmarks) that are reliably accessible, their locations are well known and constant and triangulate a large fraction of the world’s IP hosts the delay measurements provide rough estimates of the distances between the landmarks and the target which are used to geo-locate the target. Multiltateration, a concept used in [bamba], is then applied, to pin point the target host. The delay increases with the increase in geographical distance but we may get an additive delay due to a number of reasons, such as greater number of hops, congested paths, indirect routing etc. The first step is to convert the delay measurements to distance estimates based on the speed of light in fiber, perform multiltateration and avoid miscalculations caused by over-estimation caused by the additive delay. The more challenging part is obtaining ―good‖ landmarks that provide good connectivity to a large fraction of the world. Although CGB [bamba] provides a fairly accurate estimate of sites in the developed world, especially in North America and Europe, as we move outside these regions, the level of accuracy drops dramatically. The aim is to get a better coverage of landmarks, and an improved algorithm to cater for increased delays in the less developed regions. Using location data from about 600 PingER hosts in over 100 countries, we shall validate the accuracy and applicability of TULIP, and also use it to identify mis-placed hosts in the PingER database.