Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Leveraging Traceroute Inconsistencies to Improve IP Geolocation

Alagappan Ramanathan, Sangeetha Abdu Jyothi

TL;DR

This work tackles inaccuracies in traceroute-based network analysis and IP geolocation by introducing GeoTrace, a lightweight, scalable tool that relies solely on existing traceroute data and multiple geolocation databases. It employs an iterative neighbor-based refinement process and anchor IPs to identify anomalous IPs and to sharpen geolocation estimates for non-anomalous IPs, without requiring extra measurements. GeoTrace categorizes anomalies into MPLS-Affected IPs and Interface-Affected IPs, using constraint-based methods and median RTT differences to resolve locations and reduce false positives. Evaluation on RIPE Atlas data shows substantial improvements: all Interface-Affected IPs are corrected, path ambiguity is significantly reduced (SoL single-cluster from ~30% to ~60%), and country-level discrepancies in geolocation databases affect roughly 30% of corrected IPs, highlighting both the method’s effectiveness and the pervasiveness of existing geolocation inaccuracies.

Abstract

Traceroutes and geolocation are two essential network measurement tools that aid applications such as network mapping, topology generation, censorship, and Internet path analysis. However, these tools, individually and when combined, have significant limitations that can lead to inaccurate results. Prior research addressed specific issues with traceroutes and geolocation individually, often requiring additional measurements. In this paper, we introduce GeoTrace, a lightweight tool designed to identify, classify, and resolve geolocation anomalies in traceroutes using existing data. GeoTrace leverages the abundant information in traceroutes and geolocation databases to identify anomalous IP addresses with incorrect geolocation. It systematically classifies these anomalies based on underlying causes - such as MPLS effects or interface discrepancies - and refines their geolocation estimates where possible. By correcting these inaccuracies, GeoTrace enhances the reliability of traceroute-based analyses without the need for additional probing. Our work offers a streamlined solution that enhances the accuracy of geolocation in traceroute analysis, paving the way for more reliable measurement studies.

Leveraging Traceroute Inconsistencies to Improve IP Geolocation

TL;DR

This work tackles inaccuracies in traceroute-based network analysis and IP geolocation by introducing GeoTrace, a lightweight, scalable tool that relies solely on existing traceroute data and multiple geolocation databases. It employs an iterative neighbor-based refinement process and anchor IPs to identify anomalous IPs and to sharpen geolocation estimates for non-anomalous IPs, without requiring extra measurements. GeoTrace categorizes anomalies into MPLS-Affected IPs and Interface-Affected IPs, using constraint-based methods and median RTT differences to resolve locations and reduce false positives. Evaluation on RIPE Atlas data shows substantial improvements: all Interface-Affected IPs are corrected, path ambiguity is significantly reduced (SoL single-cluster from ~30% to ~60%), and country-level discrepancies in geolocation databases affect roughly 30% of corrected IPs, highlighting both the method’s effectiveness and the pervasiveness of existing geolocation inaccuracies.

Abstract

Traceroutes and geolocation are two essential network measurement tools that aid applications such as network mapping, topology generation, censorship, and Internet path analysis. However, these tools, individually and when combined, have significant limitations that can lead to inaccurate results. Prior research addressed specific issues with traceroutes and geolocation individually, often requiring additional measurements. In this paper, we introduce GeoTrace, a lightweight tool designed to identify, classify, and resolve geolocation anomalies in traceroutes using existing data. GeoTrace leverages the abundant information in traceroutes and geolocation databases to identify anomalous IP addresses with incorrect geolocation. It systematically classifies these anomalies based on underlying causes - such as MPLS effects or interface discrepancies - and refines their geolocation estimates where possible. By correcting these inaccuracies, GeoTrace enhances the reliability of traceroute-based analyses without the need for additional probing. Our work offers a streamlined solution that enhances the accuracy of geolocation in traceroute analysis, paving the way for more reliable measurement studies.
Paper Structure (8 sections, 3 figures, 1 table)

This paper contains 8 sections, 3 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. Design
  4. Identifying Anomalous IP Addresses
  5. Iterative Neighbor-Based Evaluation
  6. Resolving and Classifying Anomalous IP Addresses
  7. Results and Analysis
  8. Conclusion

Figures (3)

  • Figure 1: The distribution of unique geolocations per IP address. GeoTrace shifts geolocations closer to the ideal of 1 per IP address.
  • Figure 2: The distribution of distances from the geolocation (agreed by most sources) to resolved geolocations for Interface-Impacted IPs
  • Figure 3: Heatmap of changes in the number of geolocations for Interface-Impacted IPs at the country level.