Internet host location improves using reactive timing from unsolicited scans
Reactive Constraint-Based Geolocation of Internet Hosts
Networking and Internet Architecture
Summary
Finding where internet devices are located usually needs those devices to reply to special messages, but many devices do not respond. The authors listen for attempts from these devices to connect and reply back just enough to measure how long it takes for messages to go back and forth. These measurements closely match traditional methods and allow locating devices that would normally be ignored. The authors also used physical speed limits of signals to check if some existing location data is incorrect.
What this means in practice
- •For network security teams: Identify geographic origins of unsolicited network scanners that do not respond to probes using reactive timing measurements.
- •For content delivery network operators: Improve geographic mapping of client IPs including hard-to-reach addresses by incorporating reactive round-trip time data from unsolicited scans.
Authors
Spencer Ye, Chase Kanipe, Peter Ryan, Erik Rye
Abstract
Active IP geolocation techniques rely on the responsiveness of Internet hosts, while passive techniques depend on data sources that are unevenly adopted and prone to staleness and error. In this work, we invert the active IP geolocation problem by listening at a geographically distributed set of vantage points for unsolicited Internet scans. By reactively completing connections with these scanners, we obtain round-trip time (RTT) measurements from hosts that may otherwise be unresponsive and use those measurements for geolocation. Over the course of 20 days in August 2026, we recorded 46.8 million scans from 289,746 distinct scanners, with a reactive RTT for each scan. We show that reactive RTTs align with those obtained by sending active probes, with more than three-quarters of 990,204 measurement pairs differing by at most 10 ms. Over half of the scanners that yielded a reactive RTT did not answer our active probes, highlighting the value of our approach. We demonstrate the feasibility of multilateration using purely reactive RTTs for 56,112 distinct IP addresses. Finally, using speed-of-light constraints, we refute commercial geolocation claims for 6,852 addresses.