IP: What We Can Learn from an IP Address

In this video, we’re going to be talking about what an IP address is and why they’re important. So what can we do with an IP address? Well, with an IP address, we can identify the device. We can determine a location. We can negotiate access - allow access, route that particular device to somewhere else. We could block IP addresses, et cetera. We could remote access to that particular IP, depending on the device. So if it’s a computer, what we need is the computer IP address to remote desktop. We could flood a device.

So when we took a look at the Denial Of Service, DOS, DDOS, example, we took an IP address, and we use that IP address to identify and flood a target. We could do trace routing for troubleshooting. So say, if we’re connecting to Google, which is 8.8.8.8, and we’re having problems, we could do what’s called a trace route. And we could trace the route it takes to that particular server, and we could see what the breakdown is by IP. We can also determine a website IP by pinging it. Again, so Google’s address is www.google.com. That’s the resolve name. So if we ping www - or actually, if we’re ping google.com, what’ll come back is the IP address for that particular website.

So you’ll find that google.com is actually 8.8.8.8. So, again, all websites are broken up by IP. It’s just when we resolve to it, we use an easier to remember name, like google.com, microsoft.com, whatnot.

Now, if you want to find your IP address, you could open a command prompt on Windows and type in IP Config on Windows - or I’m sorry, on Linux or OSX. You could open your terminal, and you could do ifconfig or iwconfig, iwconfig meaning that it pulls up your wireless adapter IP address. So, again, other things we could do with IP address is we can actually find out the location. Now, location-wise, we could do things like mylocation.org, and we could find out what our IP and location is. So, again, so this is the IP address in here - 185.230.126.5. Now, using that IP address, this site is able to geolocate where this IP address is coming from.

It gives you a latitude, longitude, country, region, city, even puts it on a map where you can actually dig down and actually get a closer look at it. So, again, this is all done by an IP being assigned to you, part of that being location. So, say, for example, we’re trying to find a device and we know the IP, or someone’s hacking our network and we’re able to find the IP. We could potentially track down where that location is with a certain degree of accuracy.

So emails also will be routed by IP. So if we take a look at the header of an email, we could actually see an IP address listed here. So things like, if someone’s trying to phish you, spear phish you, or you’re trying to determine whether an email is actually being spoofed or not spoofed, we could potentially take a look at the IP address and see what the origin that actual email address is. Now, there are some caveats to this if you’re getting an email from, say, Gmail. You’re really not going to see the actual originator’s IP address. We’re going to see Google’s email address for their server.

But if you get lucky, you might be able to find the true IP address on there. Now, a VPN, when it’s working properly, will mask your real IP address. So if you’re being attacked by a malicious hacker, chances are they’re going to be using something like a VPN, or running through the TOR network, to mask their true IP address. So obtaining that IP address on your network is a first step. However, you do want to vet it, because, again, that IP address can be going through a VPN. So I’m in California. So if I use a VPN, I can potentially use one in, say, Africa, and go attack a network.

And if someone looks at the IP address, they go, well, we’re being attacked from a computer in Africa. Well, no. It’s actually coming from California, going through a VPN, going through an African VPN route, and then back to wherever I’m attacking. So we do need to be careful about that. That is one thing that will obfuscate a real IP addresses, is a VPN. So in wrapping up, IP addresses are assigned all networked devices with a unique ID. An IP address is used for essentially identification location. There cannot be a duplicate IP address on the same subnet at the same time. IP addresses can be masked if it’s hidden behind a VPN.

And IP addresses can be used for a whole slew of troubleshooting network issues or identifying intruders. So this was about IP addresses. In the next video, we’re going to be talking about phishing emails. Thank you for watching. I’ll see you in the next video.