SANS ISC: What is My IP Again? - Internet Security | DShield

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Until we all fully embrace IPv6, we're living in a NAT world.  And the folks who build security for that world often need to work around NAT that they didn't build.

Probably at least once per day, I need my current public IP address -  usually to allow myself admin access to something for a few minutes by adding my IP to an access list, sometimes to set myself up as a temporary (as in a few minutes) server to receive an exfiltrated file - it's always something.  Often I'm behind someone else's NAT gateway, so just looking isn't practical.  And even if it is a gateway I built, looking up stored configs or connecting to that firewall to check takes more time than it should.  How can we make getting this information simple and safe?

Back in the day, we used to use www.whatismyip.com or www.ipchicken.com.  However, the way the internet has gone, these sites seem more about making me look at ads than giving me the information that I really need.  And given the malvertising that we see being served up in ad services these days, I'd as soon just not go there anymore (literally).

OK, www.arin.net still gives me my public IP, with no ads.  But then I need to cut/paste it, or re-key it.  Me, I'd as soon have my computer do that.

It also used to be that ip.blindhog.net had a telnet auto-responder that gave you this info (which would also of course work with netcat), but they went offline, maybe about the time mirai gave telnet a black eye last year (??) **

So, what's left?  icanhazip.com and dyndns.org still have decent services.  You can scrape these using:

wget -O - -q icanhazip.com

or

curl -s checkip.dyndns.org | sed -e "s/.*Current IP Address: //" | sed -e "s/<.*$//"

If you want them in your clipboard, pipe them into clip or xclip (depending on your OS).

So for instance, I have a simple cmd file "getip.cmd" with either of these in it.  To get the address into my clipboard:
getip | clip

Me, I put both approaches in my "getip" script, with one commented out - you never know when a service you use every day will change or go offline.

Is there a cleaner way to get your current public IP, or a niftier scripting approach?  I have to admit, when I got to "it works" in 2 different ways, I stopped looking - if you have a better way to collect this info, by all means share in our comment section!

======
** for some telnet fun, try a telnet session to towel.blinkenlights.nl

 

===============
Rob VandenBrink
Compugen

There's a list of sites here that will return only your IP when curled > http://xmodulo.com/how-to-find-the-public-ip-address-from-command-line.html


$ curl ifconfig.me
$ curl icanhazip.com
$ curl ident.me
$ curl ipecho.net/plain
$ curl whatismyip.akamai.com
$ curl tnx.nl/ip
$ curl myip.dnsomatic.com
$ curl ip.appspot.com
$ curl ip.telize.com
$ curl curlmyip.com

I think Major Hayden, the man behind icanhazip.com, deserves a big shoutout and thank you. Check out https://major.io for his blog, additional services, and more info.

Of course I appreciate what Dyn does, too.

Even Google will correctly give you that info if you ask "What is my IP"...

There are lots:

$ curl ifconfig.me
$ dig +short myip.opendns.com @resolver1.opendns.com
$ dig +short -6 myip.opendns.com aaaa @resolver1.ipv6-sandbox.opendns.com
$ curl ipinfo.io

And of course:

$ lynx http://google.com/search?q=what+is+my+ip

Or this one, of course

$ wget -qO- icanhazip.com

All from:
http://www.commandlinefu.com/

curl ident.me

-Beau

> There are lots.

The site: www.who.is
shows my public IP-address, with a minimum of advertisements.

It is also useful for doing WHOIS searches.

Powershell:
wget http://myexternalip.com/raw | select content | fl

(wget is an alias for invoke-webrequest)

Kurt

https://www.moanmyip.com/

Awesome, thanks everyone!
Especially Beau, ident.me returns the IPv6 public IP address back!

I'll be updating my own scripts now - these are *all* likely going in, I'll have them all REM'd out but ready to go for when the first one on the list goes offline or changes ..

Surprised no one has mentioned https://wtfismyip.com/ yet.
Crass, but efficient. I find https://wtfismyip.com/text particularly useful

I use ipinfo.io, when used via curl you get a json reply by default:

e.g.
curl ipinfo.io
{
"ip": "86.187.161.99",
"hostname": "host86-187-161-99.range86-187.btcentralplus.com",
"city": "",
"region": "",
"country": "GB",
"loc": "51.4964,-0.1224",
"org": "AS2856 British Telecommunications PLC"
}

You can pipe into jq to retrieve just the IP address:

curl -s ipinfo.io | jq .ip
"86.187.161.99"

They limit to 1000 requests per day on a free option.

Nice and Handy information. Is there also a way to get the pub IP from a switch or router behind firewall? There use to be a site that telnet can be used to grab pub IP but do not think it exists anymore.

I use api.ipify.org and curl pipe to xargs/dig to retrieve hostname and ip when needing to direct the requests through a proxy:

curl --socks5 <proxy ip>:<proxy port> 'https://api.ipify.org' | xargs -i dig -x {} +noall +answer
echo


Returns ip and hostname.

Consider a second ISP and a simple server program that returns the caller's IP address.

this is all i do

www.google.com/?q=my+ip+address