GeoResolver: An Accurate, Scalable, and Explainable Geolocation Technique Using DNS Redirection

Obtaining an accurate, explainable and Internet scale IP geolocation dataset has been a longstanding goal of the research community. Despite decades of research on IP geolocation, no current technique can provide such a dataset. In particular, latency-based geolocation techniques do not scale, because, on one hand, we have thousands of available vantage points to perform measurements, but on the other hand, we have no way to select the right ones for each IP address. In this paper, we present GeoResolver, which is a serious step towards our goal, by using the idea that when multiple operators redirect two prefixes to the same servers, these prefixes should be close to each other. With this intuition, we define a methodology to measure and compare the redirection of prefixes to servers using ECS DNS measurements, and select the prefixes with the smallest redirection distance to a target prefix to issue the latency measurements to targets in that prefix. GeoResolver performs nearly as well as a brute force approach, geolocating 94% of the targets that could actually be geolocated at metro level, while using 4.3% of the probing budget compared to the state of the art. On the Internet scale CAIDA ITDK dataset, GeoResolver geolocates 16% of the IP addresses at metro level, 3.4 times more than the state of the art. In addition, GeoResolver is robust to public resolvers or hypergiants stopping supporting ECS.