Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: What is My IP Again? - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
What is My IP Again?

Until we all fully embrace IPv6, we're living in a NAT world.  And the folks who build security for that world often need to work around NAT that they didn't build.

Probably at least once per day, I need my current public IP address -  usually to allow myself admin access to something for a few minutes by adding my IP to an access list, sometimes to set myself up as a temporary (as in a few minutes) server to receive an exfiltrated file - it's always something.  Often I'm behind someone else's NAT gateway, so just looking isn't practical.  And even if it is a gateway I built, looking up stored configs or connecting to that firewall to check takes more time than it should.  How can we make getting this information simple and safe?

Back in the day, we used to use www.whatismyip.com or www.ipchicken.com.  However, the way the internet has gone, these sites seem more about making me look at ads than giving me the information that I really need.  And given the malvertising that we see being served up in ad services these days, I'd as soon just not go there anymore (literally).

OK, www.arin.net still gives me my public IP, with no ads.  But then I need to cut/paste it, or re-key it.  Me, I'd as soon have my computer do that.

It also used to be that ip.blindhog.net had a telnet auto-responder that gave you this info (which would also of course work with netcat), but they went offline, maybe about the time mirai gave telnet a black eye last year (??) **

So, what's left?  icanhazip.com and dyndns.org still have decent services.  You can scrape these using:

wget -O - -q icanhazip.com

or

curl -s checkip.dyndns.org | sed -e "s/.*Current IP Address: //" | sed -e "s/<.*$//"

If you want them in your clipboard, pipe them into clip or xclip (depending on your OS).

So for instance, I have a simple cmd file "getip.cmd" with either of these in it.  To get the address into my clipboard:
getip | clip

Me, I put both approaches in my "getip" script, with one commented out - you never know when a service you use every day will change or go offline.

Is there a cleaner way to get your current public IP, or a niftier scripting approach?  I have to admit, when I got to "it works" in 2 different ways, I stopped looking - if you have a better way to collect this info, by all means share in our comment section!

======
** for some telnet fun, try a telnet session to towel.blinkenlights.nl

 

===============
Rob VandenBrink
Compugen

Rob VandenBrink

458 Posts
ISC Handler
There's a list of sites here that will return only your IP when curled > http://xmodulo.com/how-to-find-the-public-ip-address-from-command-line.html


$ curl ifconfig.me
$ curl icanhazip.com
$ curl ident.me
$ curl ipecho.net/plain
$ curl whatismyip.akamai.com
$ curl tnx.nl/ip
$ curl myip.dnsomatic.com
$ curl ip.appspot.com
$ curl ip.telize.com
$ curl curlmyip.com
Anonymous

Posts
I think Major Hayden, the man behind icanhazip.com, deserves a big shoutout and thank you. Check out https://major.io for his blog, additional services, and more info.

Of course I appreciate what Dyn does, too.
JimC

17 Posts Posts
Even Google will correctly give you that info if you ask "What is my IP"... ;-)
Visi

40 Posts Posts
There are lots:

$ curl ifconfig.me
$ dig +short myip.opendns.com @resolver1.opendns.com
$ dig +short -6 myip.opendns.com aaaa @resolver1.ipv6-sandbox.opendns.com
$ curl ipinfo.io

And of course:

$ lynx http://google.com/search?q=what+is+my+ip

Or this one, of course

$ wget -qO- icanhazip.com

All from:
http://www.commandlinefu.com/
UnknownNick

10 Posts Posts
curl ident.me

-Beau
Beau

2 Posts Posts
> There are lots.

The site: www.who.is
shows my public IP-address, with a minimum of advertisements.

It is also useful for doing WHOIS searches. :-)
Anonymous

Posts
Powershell:
wget http://myexternalip.com/raw | select content | fl

(wget is an alias for invoke-webrequest)

Kurt
Kurt

3 Posts Posts
https://www.moanmyip.com/
phread

2 Posts Posts
Awesome, thanks everyone!
Especially Beau, ident.me returns the IPv6 public IP address back!

I'll be updating my own scripts now - these are *all* likely going in, I'll have them all REM'd out but ready to go for when the first one on the list goes offline or changes ..
Rob VandenBrink

458 Posts Posts
ISC Handler
Surprised no one has mentioned https://wtfismyip.com/ yet.
Crass, but efficient. I find https://wtfismyip.com/text particularly useful
TravisMcW

2 Posts Posts
I use ipinfo.io, when used via curl you get a json reply by default:

e.g.
curl ipinfo.io
{
"ip": "86.187.161.99",
"hostname": "host86-187-161-99.range86-187.btcentralplus.com",
"city": "",
"region": "",
"country": "GB",
"loc": "51.4964,-0.1224",
"org": "AS2856 British Telecommunications PLC"
}

You can pipe into jq to retrieve just the IP address:

curl -s ipinfo.io | jq .ip
"86.187.161.99"

They limit to 1000 requests per day on a free option.
Anonymous

Posts
Nice and Handy information. Is there also a way to get the pub IP from a switch or router behind firewall? There use to be a site that telnet can be used to grab pub IP but do not think it exists anymore.
Anonymous

Posts
I use api.ipify.org and curl pipe to xargs/dig to retrieve hostname and ip when needing to direct the requests through a proxy:

curl --socks5 <proxy ip>:<proxy port> 'https://api.ipify.org' | xargs -i dig -x {} +noall +answer
echo


Returns ip and hostname.
enc0nito

2 Posts Posts
Consider a second ISP and a simple server program that returns the caller's IP address.
robv

6 Posts Posts
this is all i do

www.google.com/?q=my+ip+address
jACKtheRipper

38 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!