How to lookup information based on IP address – e.g. for Website-visitors

6

During the last few years I have had several occasions to wonder who used the website and web-applications I had helped develop and deploy. Most recently I had this very same question for our weblog: we have had over 36000 different IP-addresses visiting our website and I have not got a clue where they come from – the time at which they visit is the only indication.

Recently I did some cursory investigations and found a number of WebServices that suggested they would return information for IP-addresses. However, I found none of them properly functioning (at least not without paying a fee). Today I had more luck. I came across the site http://www.showmyip.com/. This site provides a lot of details for your own IP-address. It also provides several services for retrieving information about IP addresses or Host Names you provide as input. You can request information for up to 100 IP addresses per day for free. Beyond that, you need to subscribe at a fee.
The information provided for IP-address includes Country, Continent, City, Host Name, Provider. For my purposes I am primarily interested in Continent and Country, so this suffices.

The service is offered through several channels:
* An interactive website – you fill in the fields of an HTML form an press a button; the results are returned as HTML or Text document
* A GET interface – using URLs such as http://www.showmyip.com/simple/?ip=64.252.69.146&get=country or http://www.showmyip.com/simple/?host=www.amis.nl&get=ip,country,city,state-name,timezone, you get returned a text-document that contains the requested information. Note that timezone and city is information only provided to subscribers.
* A WebService – the WSDL url is http://www.showmyip.com/soap/lookupserver.php?wsdl; using for example Oracle JDeveloper, it took me all of one minute to create a Client Application for this WebService, giving me a programmatic access to IP Address information.

The next step for me will be to create a batch process that will use the WebService Client to get hold of IP Address data (Country and Continent) for the top 100 Visitors of the day. Given the total of 36000 IP addresses and the growth from new visitors it may be some time before we have checked all visitors, but before too long we should have a pretty good indication of the origin of the majority of our visitors.

JDeveloper WebService Client Application

The JDeveloper project I created – or better said; generated – for accessing the WebService at showmyip.com is show in the image below. More precisely, the image is a snapshot of the debug-mode, right after invoking the WebService client. In the Debugger SmartData Window we can see the properties returned by the WebService for the IP address under scrutiny.
JDeveloper Client Application for calling the ShowMyIp WebService
The entire JDeveloper (Release 10.1.3) project can be downloaded here: IPLookupWebService.zip

Share.

About Author

Lucas Jellema, active in IT (and with Oracle) since 1994. Oracle ACE Director for Fusion Middleware. Consultant, trainer and instructor on diverse areas including Oracle Database (SQL & PLSQL), Service Oriented Architecture, BPM, ADF, Java in various shapes and forms and many other things. Author of the Oracle Press book: Oracle SOA Suite 11g Handbook. Frequent presenter on conferences such as JavaOne, Oracle OpenWorld, ODTUG Kaleidoscope, Devoxx and OBUG. Presenter for Oracle University Celebrity specials.

6 Comments

  1. Friendly User on

    Very helpful information — appreciate your taking the time to post in detail. Just a comment to give some feedback that your efforts are beneficial to other. Have a great day!

  2. Lucas Jellema on

    To follow up on the previous post, the IP Ranges in the ip-to-country.csv file are in numeric value. So instead of 10.21.232.22 or something like that, the range is indicated by integers.

    An IP address can be compared to these range-boundaries by first turning it into an integer itself. That is done by the following function – for IP Address = w.x.y.z.:

    IP Integer = w*256*256*256 + x*256*256 + y*256 + z

    So for example the address “209.207.224.40” should be converted to 209*256*256*256 + 207*256*256 + 224*256 + 40 = 3520061480. That number can be compared to the IP ranges in the file.

  3. Here the URL’s that didn’t show up in my last post:

    AWstats: http://awstats.sourceforge.net/cgi-bin/awstats.pl
    Ip Adresses via AWstats: http://awstats.sourceforge.net/cgi-bin/awstats.pl?framename=mainright&output=allhosts

    Etc.

    Ip adresses can be tracked by most analyzers, what the use to combine them with arpa lists of contries is “reverse DNS lookup”. If i am not mistaken, this can be done via Webalizer. The problem with this is that an extra deamon process is needed and therefor an extra entry for hackers has to be protected against unwanted entries.

  4. There are some very usefull and powerfull statistic programs. For instance one, an opensource, tool
    is
    AWStats
    It gives you not only a lot of usefull info about ip numbers en countries,
    but also information about exit codes. These exit codes are interesting to see if your site is working properly PLUS if there are people who try to hack there way in… AWStats is written in perl, but there are alternatives.

    An other tool is Webalizer.
    A sample report can be seen at http://www.webalizer.com/sample/usage_199905.html

    Some overview of “log analysers” can be found at: http://www.thefreecountry.com/webmaster/loganalyzers.shtml