How do I find the geographical location of a host, given its IP address ?

In general, it is impossible - IP addresses are allocated arbitrarily, as there's no inherent connection between an IP address and it's physical location, and there's no reliable method to do the trick.

Yet, doing some detective work could help. Try following methods :

  1. Note the following links for reference :

    A complete list of country codes

    A complete list of U.S. state abbreviation

    A complete list of airport codes

  2. Use reverse DNS to find out the host's name. This item could supply some clues that could help.

    E.g. given the IP address, the command 'nslookup' translates the address to gives two hints -
    1. The TLD is .il, which hints the host is in Israel.
    2. The next two domains are, so this host belongs to the 'haifa' academical institute (a university, in this case). The Haifa university happens to be in the city Haifa.

    Reverse DNS translation doesnt always work - it depends on the host's [the host with the given IP address] DNS server's correct configuration.

    Another trick is to execute a whois request on the IP address. Try to direct the whois query to - if it doesn't have the reply it will tell you to query either or

    Notice that a host in one domain might be hosted in another country. This is due to both virtual hosting, where a domain of a company from one country or region, might be hosted where hosting is cheap.

    Also notice that the .org, .com, and even .edu domains does not imply the host is in the U.S., as many of those domains belong to companies that are either not U.S. based, or are international, and might have some hosts all over the world.

  3. Some hosts support a DNS extension which allows for hosts to enter their geographical location into their DNS record, based on an extension to DNS described in RFC 1876.

    For further information see -

    Another attempt to express a host's geographical location via DNS is done in RFC 1712. Both RFCs define a DNS Resource Record to contain the geographical location.

  4. Visit the host's web server. A web site will sometimes contain hints regarding the site's location.

    E.g. for, you can find info at both and

  5. Use whois. The whois database contains administrative contact info for all domains, filled in during domain registration time, and updated from time to time. This admin info could give some hints.

    The whois database is not highly reliable - if an address belongs to a large & responsible company, the company will supply reliable info and update it, but as domain name registrators do not insist on keeping the database accurate and current, the data might be incorrect.

    The page allows whois requests for many countries.

    A list of whois servers, collected by Matt Power, is available at

    Note that the data is usually given for the owners' main branch or contact points, but the IP addresses might be allocated to hosts that may be located at a different location(s).

  6. Use traceroute. The names of the routers through which packets flow from your [or any] host to the host with the given IP address might hint at the geographical path which the packets follow, and at the final destination's physical location.

    E.g. > traceroute
    traceroute to DANDELION-PATCH.MIT.EDU(, ...
     1 (              2 ms   1 ms   1 ms
     2 (            5 ms   5 ms   5 ms
     3 (              9 ms  11 ms  13 ms
     4 (   535 ms 549 ms 513 ms
     5 (        562 ms 596 ms 600 ms
     6 (               1195 ms1204 ms
     7 (  1208 ms1216 ms1233 ms
     8 (                 1210 ms1239 ms1211 ms
     9 (    1069 ms1087 ms1122 ms
    10 (           1064 ms1109 ms1061 ms
    11 (    1185 ms1146 ms1203 ms
    12 (     1185 ms1159 ms1073 ms
    13 (                1052 ms 642 ms 658 ms
    14 W20-RTR-FDDI.MIT.EDU (            640 ms 665 ms 674 ms
    15 DANDELION-PATCH.MIT.EDU (        702 ms 915 ms 868 ms

    The 3rd hop takes the path to the academic network [checked by local whois lookup], the fifth hop takes the path to New-York [on the east coast], and the 10th hop takes the path to Cambridge [in Massachusetts, on the coast, northern to New-York].

    There is a utility named VisualRoute ( which traceroutes a host, and displays the route on a map of the world. The host's location on the map is based on the whois query, which may be wrong - an Israely domain might be displayed as being in Israel though it is hosted in another country.

  7. Some of the services available on the host might give further info.
    E.g. telnet 13  <== Time of day service
         Connected to
         Escape character is '^]'.
         Wed Jan 21 08:32:53 1998         <== Time difference hints at the host's time zone.

  8. Naming conventions of ISPs and back-bones

    AT&T dialups : <port>.<router-location>.<state>

    Port is 2-254 for the dial-up ports, and 1 for the router itself. location: example: "los-angeles-2" (city and router #). state: 2-letter abbreviation.

    (Thanks to D. Stussy) dialups :
    A. <port>.<device>.<city>.<state>.<iu>
    B. <port>.<device>.<airport>.<iu>

    iu = intended use (meaningless), state is per USPS ZIP code, deviceis Ascend 'TNT' # or Ascend 'MAX' #.

    (Thanks to Robert Bonomi)
    (Thanks to John Bradshaw)

  9. Related sites :

    The Mappa.Mundi Magazine -
    Cyber Geography -

Back to my home page.