Using GeoIP Services to Augment a Digital Investigation

By John Carruthers ·

IP to geographical correlation is not something new. However, when performing digital investigations it can be helpful when trying to separate traffic originating from known good locations versus suspicious locations.

How does IP to location translation work?

GeoIP data is not 100% accurate, but it can get very close. When discussing the accuracy of GeoIP, it is important to understand how the location data is gathered. The Internet Assigned Numbers Authority (IANA) is the organization responsible for all IP addresses in the world. IANA divides all of the IP addresses up between five Regional Internet Registries (RIR). The RIR territories are shown below in the graphic.

After that, the RIR assigns IP addresses to ISPs. From there it is up to the ISP to accurately register that and its physical location. The last stage is where the inaccuracies can occur. ISPs can get as granular or as vague as they want.

Investigating Suspicious VPN Logins – Use Case

Depending on the geographical spread of your company’s employees you can use GeoIP data to check the physical origination of VPN connections. For example, if your business is only in California and your employees are allowed to connect from home using VPN, it would be easy to run all of the connecting IP addresses through GeoIP and filter out who connected from outside of California.

If you had connections coming in from outside California, you could check with those particular users and confirm they were near that area during those times. If they were not, this could be an attack from someone who has compromised that account.

Geographical IP Correlation (GIPC) - A Tool

Last year, I released a tool to help me quickly take a very large list of IP addresses and pull the location data. The tool can display the results within itself, generate a CSV file and generate a heat map using the Google API. A screenshot of the tool is below on the left and the heat map that it generates is on the right. The tool can be downloaded here: http://sourceforge.net/projects/jcsocal/

This tool requires the MaxMind Geo IP Database. While they do provide a free version of the database, keep in mind that some of the information may be outdated. If accuracy is important, it may be worth purchasing their commercial database.