I have a general question about IP Addresses. I am not sure if this question is better suited for another S/O Network (like Server Fault), but I thought I'd ask it here.
I want to try to hone in on the relationship between an IP Address and a Country. Is it fair or accurate to say that an IP Address like 100.*.*.* relates to ISPs in the US solely or is it possible that one of the octets with the 100.*.*.* range gets assigned to other Countries?
I am looking for a way to relate IP Address ranges, at their highest level, to Countries on a one-for-one basis.
Thanks.
I don't think there's an explicit rule for that. Check here.
Strictly-speaking, it is my understanding that location roughly correlates with location via IPv4 address blocks. There's a Wikipedia reference for these here.
However, more often than not this isn't particularly accurate - from personal experience relying on these results in more false results than positive. Part of the problem is that these addresses tend to shift with time and use.
MaxMind offer a free geoIP database called GeoLite 2 (link here) which I've used on a few occasions to detect an IP's origin country with a really high success rate, you just have to make sure that you update the database fairly regularly to keep up-to-date.
Related
I am wondering how, on a technical level, IPv4s and domains can be distinguished.
An IPv4 takes the form [0-255].[0-255].[0-255].[0-255].
A domain takes the form (a)+.b, where (a)+ denotes that this string occurs at least once and may repeat.
The values of a can be considered arbitrary alphanumericals (so yeah, mathematically, I am not super correct with the expression above), as can the values of b, though b has practically more restrictions because it must usually be registerd Top Level Domain (TLD), but apart from that, may be arbitrary alphanumericals, either.
In theory, the set of ip addresses looks like a subset of the set of domain addresses.
Edge cases like special characters and special addresses are not relevant for this question and can be ignored.
When I enter an IP or domain into my browser address field, the terminal, or an application, how does the system know whether I entered a domain that requires resolution, or an IP address that can be directly contacted?
Can someone, on a technical level, explain how the system handles these strings and what possible interactions can occur and whether (and why) this raises security issues, or not?
I was wondering, whether an attacker would be able to exploit this ambiguity and whether there are cases where exactly this already happened in the past.
I'm refactoring some of my network code due to Apple's guidelines to support full IPv6 networks, and they state one reason for this is that carriers are starting to make the conversion.
When I test with Apple's NAT64 network, I see IPv4 addresses coming in mapped to IPv6 in the form:
64:ff9b::xxxx:yyyy
Based on the NAT64 spec, it seems there are other possibilities, but I am not sure if these are ever used.
I'm hoping that I can just assume the above format, but I would like to know what NAT64 mapping styles other phone carriers are using.
EDIT: I omitted an important detail from my original question - that I need to do some filtering based on IPv4 ranges in certain scenarios. So I need to be able to convert IPv6 to IPv4 for the addresses where that is possible.
There are many ways. Don't assume anything. Query the DNS64 and use what you get. Everything else will break.
I am trying to geo-locate 500 or so IP Addresses. Several online services say that for, for example, 50 addresses, 50% are in California and the other 50% in Colorado.
How do you accurately geolocate an IP address and why are some of them so off?
Thanks!
Maybe this Question is what you're looking for:
How does IP geolocating work?
The Reason why some Addresses are concentrated on single points, could be that if for a specific IP Address no entry exists, they match it to a predefined point, for example the country or town the ISP belongs to.
There is no way to get real accurate information (as mentioned in the link).
I am wanting to block every country EXCEPT USA,Mexico, and Canada from my ecommerce site. From the research I have done, using an HTTPModule would appear to be the best method. However, this would require me going through a list of hundreds of ip ranges and woudl require quite a bit of code
Anyone have nay ideas on a quick way to do this?
Even if you did block IP address range this would change as the get reallocated or taken up. Also its possible to use a number of services to spoof IP addresses or even to go out through routers / gateways in other countries even if you're not in the places you want.
You could try looking at the locale and / or time-zones set on the client machines. whilst this is not infallible and can be worked around (if the client knows what you're doing to block them),
They are en-us, en-ca, fr-ca, es-MX, it's the letters after the dash that you want, which are the ISO 3166 Codes for Countries. This may give you a start, it's not a infallible, but you're not going to get that anyway, but its a very light weight way of removing a fair amount of visitors.
IMHO, the best approach: application and/or network firewall (appliance) rules (having said that, if you have one, this may even negate the need to do IP address filtering entirely)
IIS
I'm trying to make a list of all MAC addresses that are reserved, do not exist, should not be used, should only be used locally etc. (Just like the list of reserved IP-addresses on Wikipedia, but for MAC.) Basically I want to loop over all MAC-addresses from a switch and filter out the "real" ones.
This page suggests all addresses starting with 00-00-5E or 01-00-5E are reserved, but when I look them up it seems like 00-00-5E is also assigned to the Information Sciences Institute (part of a university in California).
So 2 questions:
1) Is there any place I can find a list of reserved MAC-adresses?
2) What's up with 00-00-5E? Is only part of that range reserved, or is there some reason they assigned it to ISI?
I was just looking into this myself recently. I believe that the IANA (which you refer to in one of your links) will give the most authoritative answer: IANA Ethernet Number Assignments
I don't think that this means that these addresses can never be used though. According to RFC5342, Section 2.1
"The 2**8 unicast identifiers from 00-00-5E-00-00-00 through 00-00-5E-00-00-FF are reserved and require IESG Ratification for allocation (see Section 5.1)."
So basically, it appears you need special permission from IESG (Internet Engineering Steering Group) to get an address in that range, which I suppose the ISI has obtained somehow.
Section 2.1 of RFC5342 deals with 48-Bit MAC Identifiers and OUIs, and it doesn't make any mention of any address ranges that are strictly forbidden or permanently reserved from what I've understood.
The following OUI are reserved as per RFC 5342:
OUI 01:00:5E:(00:00:00-7f:ff:ff) - Used for IPV4 Multicast and MLPS Multicast.
OUI 00:00:5E:(00:01:00 – 00:01:FF) - Used for Virtual Router Redundancy Protocol (VRRP) IPV4
OUI 00:00:5E:(00:02:00 – 00:02:FF) - Used for Virtual Router Redundancy Protocol (VRRP) IPV6
OUI 33:33:00 – 33:33:FF - Reserved for IPV6 Multicast
OUI CF:00:00 – CF:FF:FF - Reserved by IANA for PPP(Point to Point Protocol)
OUI 00:00:5E (00:00:00 - 00:00:FF) - Requires IESG Ratification for allocation.
Was looking into this myself.. I know it's been a while since the post was active.. but I found these to be ok to use locally:
x2-xx-xx-xx-xx-xx
x6-xx-xx-xx-xx-xx
xA-xx-xx-xx-xx-xx
xE-xx-xx-xx-xx-xx
Source: https://honeywellaidc.force.com/supportppr/s/article/Locally-Administered-MAC-addresses
The registration authority for MAC addresses is the IEEE. It hands out OUIs (Organizationally Unique Identifiers), which give you a three byte prefix, and 2^24 addresses within it, for a fee (currently 2 995USD). You also get the rights to the corresponding multicasts, which have the prefix with the lowest bit of the first byte set. For instance, 00:80:C2 is allocated to the IEEE 802.1 committee, which uses 01:08:C2:00:00:00 for Spanning tree.
So, there isn't really a list of reserved addresses. There is a list of OUIs that have been allocated, unless the buyer has paid (a lot) extra for privacy. You can use any address that has the local bit set freely. A tiny fraction of multicast addresses have a significant meaning because heavyweights like IEEE, Cisco, IANA assign meanings to them. From the IEEE registration point of view, there is no particular significance to these blocks (except possibly to those it has allocated to itself).
Now, how did the 01-00-5E range end up allocated to the Information Sciences Institute? The simple
answer is that they paid for it. So, really the question should be 'how did the Internet get to use part of the range allocated to ISI?'. The answer is that the IANA used to be run from an office in ISI: specifically IANA was the legendary Jon Postel
Bottom line: you are on a bit of a fool's errand. You can distinguish local addresses and multicast addresses, and make some attempt to tie up allocated unicast addresses to vendor blocks. And you can probably do a bit more with well-known multicast addresses but only by tracking down individudal vendor's documentation (IANA is obviously an important one but only definitive for 1 of the 2^22 available blocks). One of the best places to start is probably the Wireshark codebase.