What information does an IP address provide

Question

For example, if I use a web app that saves my IP address, what can be inferred from it?

What can be deduced from an IP address (and to what degree of certainty)?

Is it always possible to determine a user's geolocation given an IP address?

Answer 1

An IP Address is a network identification number that allows one address on the internet to communicate to another address. Given that one place can send data all over the internet to your location and back, it is logical to understand that if software can do it, so can other software.

There are 2 versions of IP Addresses. IPv4 and IPv6 addresses. Both work differently from the other, so I'll be talking about IPv4 (xxx.xxx.xxx.xxx) addresses.

On the internet, A corporation called IANA registers ranges of IP Addresses valid for different countries. Per country, each ISP is given a small set of IP Addresses that they are allowed to hand out. Because there are more people than available IP Addresses, IP Addresses are not assigned to a person or domain unless an additional fee is paid for it.

Lets assume this is not the case. If a user disconnects from the internet, or their DHCP lease expires, the ISP may give out a new IP Address. Usualy an ISP will only do so for disconnected users where it needs to assign an old used IP to a new user because it ran out. If that first person then connects to the internet again, and his/her IP was handed out, they'll get a new IP Address.

Whenever you query a whois on an IP Address, you always will see which company is responsible for handing out that IP Address. This is either the ISP or webhosting.

Because the whois information also lists the name + address details, it can be figured out upto a reasonable detailed GEO location to where the IP is residing.

If someone uses a major ISP in a country, the WHOIS information will tell anyone which country that person lives in. Some sites however seem to have a database that seem to be able to go up to city/street level about pinpointing where an IP Address originates from. Although these sites are not always accurate, there are ways to find someone's location.

But because someone's ISP can always be found by the IP Address, and the whois information always lists an email address to send abuse complaints to, it is always possible to find and punish people who are abusive on the internet in one way or the other.

Whenever you get an internet connection, you always have to agree with the terms, whicn state that no abusive activities are to take place. If complaints get to the ISP, they can suspend or even terminate the internet connection.

Answer 2

An IP address is often uniquely tied to you by your ISP. This means that if your ISP co-operates with whomever has the IP address, they can determine your identity and therefore what services you have been using on the Internet.

However you can never guarantee that the IP address you're connected to is actually tied to the identity you think it is. It is almost always possible that someone else has access to the IP, either because there's an insecure wireless access point there or because it's an open proxy/VPN service.

Regarding geo-location Often the fact that an ISP 'owns' or has access to a block of IP addresses means that it is quite well established who gets assigned an IP from this range. Hence it can be simple to identify an approximate location. However this comes down to how that ISP hands out IP addresses. Some will not pay any attention to geographic locations and therefore the precision of geographic location from the IP address can be very low.

Answer 3

An IP address is often a volatile thing - you may have one now, and a different one in five minutes. Further, it may only get to your "front door". If you have a wireless router at home, you may have several computers behind this wall. The IP address doesn't tell anyone which computer is connected.

The best information about the location of an IP address comes from the switch / router closest to your house. Your ISP is responsible for that "last mile" of your connection - and will know exactly what router (billing address) a particular IP address is associated with.

Importantly though, this might only be the entry point (firewall) to another network. My (large) employes uses a proxy server in California. When I connect to the internet while at work, you might think I was in CA but that is not so.

Incidentally a "trace route" can be used to find the intermediate points (routers) that get the signal from one place to another. These intermediate points often have names that tell you something about the routers' position - without needing to look things up.

Answer 4

When not using so-called IPv6 Privacy Addressing, IPv6 addresses might include your computer's unique MAC address. That means that the very same MAC address will be presented to the server, no matter to which IPv6 network (home, school, office, internet café) your computer is connected. A super cookie, if you will.

Luckily, nowadays IPv6 Privacy Addressing is the default setting for Windows and OS X. I don't know about Linux, and I don't know what the setting is for old systems that were upgraded to recent versions of Windows or OS X.

Details (and how to prevent it) in How to avoid exposing my MAC address when using IPv6?