Where user came from?

Anon

Im building a website stats manager, how do you find out where the user came from? Thanx for you help!!!

Jason Rottman

plutarck

You want the http referer, usually available in PHP as $HTTP_REFERER. It's an environment variable with most web servers, if it's set.

neville

That is ok If you want to know which url the visitor came from.. but how do you track which country the user came from.. how do we use the REMOTE_ADDR variable to do this. Is there like a database of IP adresses and the corresponding countries that they belong to for eg in the following IP number: XXX.aa.bb.CCC

wouldn't XXX be able to represent a particular country ?, or be a number that is assigned to a particular country ?

Thanks.

kparker

Yet another item urgently needed in the non-existent FAQ.

Whether or not there is any correspondence between an ip address and a country depends on what you mean by "correspondence":

(1) What country is the company who "owns" the address located in?

(2) What country does the TLD of the domain name that maps to the address represent?

(3) What country is the server physically located in?

(4) What country is someone whose browser originates from a particular ip actually in?

I've ranked these in more-or-less increasing order of difficulty. For (1) you can just go to ARIN, RIPE, or APNIC''s web page and ask. (2) used to be easy except for .com, .net, edu, and .org, but now that some places are just selling domains to anyone (e.g. .tv) not all country codes mean something anymore. If there is a way to easily find out (3), I'm not aware of it, though a traceroute is often informative as the backbone folks tend to give their routers helpful names. (4) is easy if you can tell that the host is a single-user system (e.g. Win9x, Mac) but otherwise you have no idea--coming from a unix host or even a WinNT server (could be citrix/terminal services) it could be anyone from anywhere.

plutarck

The XXX part of the IP like you mentioned has to do with the...well I can't remember the name of what I'm trying to say.

Back when IP blocks were being passed around, certain prefixes were assigned for certain uses. 64 is...I want to say "tier" 1...well anyway, IP has little/nothing to do with the country that it's used in. Wouldn't that be nice though? hehe

There is a program called VisualRoute, and other programs of a similar nature, that use traceroute plus various other little tools to figure out the last known destination of a packet.

For instance I once discovered that a site was hosted in Hong Kong, in what was, according to the name, a nunnery.

So as Kirk said, finding the country of any request is nigh unto crazily difficult.

It falls into the "just ask them" category of accepting futility.

neville

An ISP usually gives statistics for a particular site as to how many times a page has been visited and stuff like that,.... it also gives the country from which the request was made if I remember correctly ... so how do those guys who wrote that program do it... How do I trace the actuall point from where a request or lets say a mail was sent?........ I think the XXX in the IP address has some thing to do with the geographic location of the host server and can be used to track the country the request was made from .... I could be wrong..

While we are on the subject I'd also like to know, how did the guys track down the authors of the "I LOVE YOU" or "MELISSA" virus ?

Thanks for listening even though I digressed a bit.

kparker

An ISP usually gives statistics ... [including] the country from which the
request was made ... so how do those guys who wrote that program do it.

Easy--they do it by deciding the alternative (of my 4) they wish to
consider, whether or not it's the one you'r interested in. In the case of web logs, they're just looking at the country code of the domain name, which has nothing inherent to do with the IP.

For example, I have a friend up here in Puget Sound Country (Seattle, WA, USA) who hosts a little vanity domain for another friend in Denmark. So when you get a visit from this particular IP and it resolved back to a .dk host name, it might indeed be friend B (actually in Denmark) who has logged into friend A's server and is browsing your site from there, or it may just be friend A who is testing things on friend B's virtual domain, but in either way the actual traffic originates from a box in Washington state.

I think the XXX in the IP address has some thing to do with the
geographic location of the host server

Again, not inherently, but since addresses are handed out in blocks of course you have a proximity effect.

neville

Hey thanks Kirk...... I'd like to read some more on this topic though. ..... could you point me to some web site that has gives such reading ..... I searched but got nothing straight forward.

Thanks again.

kparker

Sorry, I have no idea. What I stated here comes from bits and pieces floating around the back of my brain these days...