Last updated on October 10, 2020 by Dan Nanni
If you want to find out where a given IP address is physically located on earth, there are quite a few online GeoIP lookup services you can try (e.g. geoiptool.com). These online services are mostly powered by freely available GeoIP databases such as those from MaxMind. Besides using such web-based services, there are different ways to query the GeoIP databases, notably via the Linux command line.
In this tutorial, I am going to describe how to geolocate an IP address from the command line in Linux.
The first method is to use
geoiplookup tool which is a command-line client for MaxMind's GeoIP databases.
geoiplookup allows you to look up the geography or network information of an IP address (or hostname). You can install the tool (along with the free GeoIP database used by the tool) as follows.
geoiplookup on Ubuntu, Debian or Linux Mint:
$ sudo apt-get install geoip-bin
geoiplookup on Fedora:
$ sudo yum install geoip
geoiplookup on CentOS/RHEL, first enable EPEL repository, and then use
$ sudo yum install geoip
The default installation of
geoiplookup comes with
GeoIP.dat database file which is located in
/usr/share/GeoIP. With this database, you can look up the country information only.
$ geoiplookup 188.8.131.52
GeoIP Country Edition: US, United States
You can download additional GeoIP databases from MaxMind, which give you more detailed information about IP addresses beyond country info. You can also download more up-to-date
GeoIP.dat from the site. This is recommended because
GeoIP.dat may have already been outdated by the time you install it from Linux repositories. The GeoIP databases available on MaxMind website are updated every month.
To install additional GeoIP databases from MaxMind, do the following. You may want to set up a monthly cronjob to automate this process.
$ wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz $ wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz $ wget http://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz $ gunzip GeoIP.dat.gz $ gunzip GeoIPASNum.dat.gz $ gunzip GeoLiteCity.dat.gz $ sudo cp GeoIP.dat GeoIPASNum.dat GeoLiteCity.dat /usr/share/GeoIP/
Now if you re-run
geoiplookup, you will see the additional AS number information of an IP address. This basically tells you which administrative domain the IP address belongs to.
$ geoiplookup 184.108.40.206
GeoIP Country Edition: US, United States GeoIP ASNum Edition: AS88 Princeton University
When run without any parameter,
geoiplookup tool automatically uses
GeoIPASNum.dat only, but not use
GeoLiteCity.dat. The latter can give you city-level information.
To obtain city-level geolocation information, explicitly tell
geoiplookup to use
$ geoiplookup -f /usr/share/GeoIP/GeoLiteCity.dat 220.127.116.11
GeoIP City Edition, Rev 1: US, MA, Cambridge, 02142, 42.362598, -71.084297, 506, 617
The output includes state, city, zipcode, latitude and longitude. The accuracy of the inferred location varies across different countries and networks. For example, the geolocation result tends to be more accurate for broadband IP addresses, but not as accurate for mobile networks.
If you want to avoid the hassle of installing and updating GeoIP databases, you can try
ipinfo.io online service. Unlike other services,
ipinfo.io provides JSON-based geolocation API, so you can easily look up geolocation from the command line, using tools like
$ curl ipinfo.io/18.104.22.168
Note that the access to their API is rate-limited at
1,000 API requests per day.
Please note that this article is published by Xmodulo.com under a Creative Commons Attribution-ShareAlike 3.0 Unported License. If you would like to use the whole or any part of this article, you need to cite this web page at Xmodulo.com as the original source.