The good news is that doing these geolocation lookups isn’t only for the big corporate and mega websites. There are a number of free online services and even a command line tool for Linux which allows you to lookup IP addresses and get information about where that address is assigned. This can be very useful when you are investigating a suspicious email or strange comments left on a blog. It is also useful when using services that mask your IP address, like a VPN, to ensure that they are working as advertised. To look up an IP address from the Linux command line, you need to install the “geoiplookup” tool. For Ubuntu and Raspbian use: To lookup an IP address type the following: Replace 8.8.4.4 with the address you want to look up. In this example, the address 8.8.4.4 (which is one of Google’s DNS servers) is correctly reported as an address from the USA. The database provided with your Linux distribution is probably out of date; you can check to see when it was created using the -v flag: In this case, we see that the database was created in August 2013. The geolocation database is provided by MaxMind, and the company refreshes its databases every month. You can update the database by downloading the latest files directly from MaxMind.com. You can now query the database again for its build date: The tool now reports that the database was created in April 2014. MaxMind also provides a City database, which in many cases gives greater accuracy. To install it, use the following commands to download the database and copy it to the GeoIP directory: To get the city information, you need to tell the “geoiplookup” tool to use the city database: This time, geoiplookup tells us the address is in Florida and more specifically in Summerfield, Florida.
Online service
As well as the geoiplookup tool, there are a number of online services which can provide geolocation information. For example, if you open geoiptool.com in your web browser, the site will give you information about your current location. Another site freegeoip.net has an API which is designed to be used in the backend of websites or from within applications. However, it can also be used from the command line using “curl.” First, ensure that you have “curl” installed: To get geolocation information in XML format, use: The XML output reveals that the IP address 72.4.9.242 is used in Evansville, Indiana. You can also get the same data in CSV or JSON format by changing the “xml” part of the URL to “csv” or “json” respectively. The geoiplookup tool and the online services can be very useful. If you have any questions about using them, please ask in the comments section below.
