-1

Malicious Traffic detected from an internal IP in Wide Area Network (Network of multiple cities in a country). How to find the city of that IP address in Wide Area Network? There is no IP subnet by location. Randomly IP addresses are allocated. ICMP traffic not allowed. Traceroute and ping won't work. Is it possible for seeing route history for that IP address? Or any other techniques? How to locate malicious IP by city in the network?

2
  • Are you outside this WAN? May 2, 2019 at 15:04
  • Talk to the people that assign the IPs in the WAN.
    – schroeder
    May 3, 2019 at 6:56

1 Answer 1

2

You can use tcptraceroute. As this is TCP is will bypass most ICMP filters.

tcptraceroute sends TCP SYN packets and replies with a RST packet if it gets a SYN|ACK

https://linux.die.net/man/1/tcptraceroute

For cisco switches one could use Show ip route address

2
  • Yes, but it won't work if intruder scanned from host machine (no ports opened) and also won't work if machine is in offline.
    – user95437
    May 2, 2019 at 14:37
  • Thanks for response. What if multiple hops are between source and destination?
    – user95437
    May 2, 2019 at 14:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.