Icanhazip: A simple IP address tool survived a deluge of users (2021)

https://blog.apnic.net/2021/06/17/how-a-small-free-ip-tool-survived/

by broken_codez • 3 years ago

299 139 3 years ago

blog.apnic.net

tl;dr: Bought by Cloudflare.

cryne• 3 years ago

...for a symbolic price because "the fun totally dried up" for the author and he felt the site would be in good hands at Cloudflare.

alpb2• 3 years ago

Their sponsorship of icanhazip.com has saved me tens of thousands of dollars per month.

Can someone please explain how does returning a few hundred bytes of plaintext response can cost thousands of dollars? Either I'm really bad at estimating things or there's some hidden cost somewhere I'm not seeing.

Also why could it not work fine behind a Cloudflare free tier?

karamanolev• 3 years ago

In 2021, the traffic I once received in a month started arriving in 24 hours. The site went from a billion requests per day to 30-35 billion requests per day over a weekend.

30 billion times 350 bytes (size of my response) is equal to 10.5 terabytes (base-10) a day. 84 terabits per day, 84000/3600/24 ~= 1 gigabit if my math is right. A fully saturated 1 gigabit pipe of worldwide internet costs a lot. So, there.

bunga-bunga• 3 years ago

It mentions 2 petabytes of data per month, plus compute for a trillion requests per month. It sounds like all kinds of optimizations were made so probably it can’t be much cheaper. My guess is that the “tens of thousands” is calculated on CF Workers prices though.

veave• 3 years ago

Also why could it not work fine behind a Cloudflare free tier?

Eh, how would that even work? You have to serve the requests anyway.

ChrisClark• 3 years ago

For $8.

metadat2• 3 years ago

Discussed at the time:

A New Future for Icanhazip

https://news.ycombinator.com/item?id=27415537 (2 years ago, 253 comments)

sunshinekitty• 3 years ago

A great tool I’ve used countless times after learning about it while working at Rackspace a decade ago . It was great to learn about how it’s grown over the years, what an ordeal!

Cloudflare is at the top of the list of custodians I would want if in a similar position, glad it’s found a new steward.

politelemon• 3 years ago

That's a great read, the author had a passion project and stuck by it. I'd love to read more of these

ComputerGuru3• 3 years ago

Not related to the story of scaling the tech but rather to the IP business in 2023:

I’m not affiliated with any of these services, but my goto has been ip4.me, ip6.me, and ip6only.me because they’re short and memorable and because they acknowledge the IPv4/IPv6 split. The first two domains give you your v4 and v6 IP respectively and the latter only resolves over IPv6 (useful to ensure your IPv6 is off when using a VPN). You can tack on /api to any of them to get a plaintext response.

0x6A75616E• 3 years ago

the issue is that these return a bunch of html so using them from the command line is not ideal.

I made wgetip.com back in 2008 to solve this. icanhaz must've been pretty suboptimal back then to have issues with traffic. wgetip still gets about 3M requests per hour. All from a single $5 droplet.

zokier• 3 years ago

ip4.me and ip6.me have /api endpoint for programmatic access

pepa658• 3 years ago

Best thing to try first is to append /ip I've found.

For wgetip.com that is not needed of course. But I haven't found a way to get the IPv4 address there...

NelsonMinar• 3 years ago

https://www.ipify.org/ is my go to, mostly because it has a really simple JSON version. Funny how many ways there are to do this simple thing.

pepa658• 3 years ago

https://api.ipify.org/ works to just get text IP.

pests• 3 years ago

Does Chrome not recognize the .me TLD? I just tried to type that ip4.me domain twice and it just sent me to search results.

kiwijamo• 3 years ago

Edge works just fine which is interesting.

owenmarshall• 3 years ago

I think that would be very surprising to the fine people of Montenegro.

Check your local DNS configuration and your spelling, something is likely hijacking NXDOMAINs.

bla3• 3 years ago

Works for me (heh).

paradox460• 3 years ago

I like ifconfig.me because it returns the IP along with some other little bits of useful information, and works great with curl

erinnh4• 3 years ago

Icanhazip.com will do the same.

They have ipv4.icannazip.com and ipv6.icannazip.com where they will return that.

sitzkrieg• 3 years ago

so 3, 2 less memorable sites, ok got it

reincoder• 3 years ago

ipinfo.io's API and site is dualstack. But for IPv6 connection, you need to use v6.ipinfo.io for the API service.

Even though nobody asked, I have to mention this every time there is a discussion about IPv6 and IP address data. According to domain name records, even if a site supports both IPv4 and IPv6 it defaults to IPv6. I would love to know why.

I have come across a lot of people saying IPinfo doesn't support IPv6. The internet as an ecosystem doesn't completely support IPv6, but we do. So, mentioning it constantly in every discussion is my current approach.

toast02• 3 years ago

According to domain name records, even if a site supports both IPv4 and IPv6 it defaults to IPv6. I would love to know why.

Newer is better? Good clients use the 'happy eyeballs' (rfc 8305) mechanism, which is roughly, open v6, wait a bit, open v4, use whichever connection comes back first. There's a bias towards v6 because often it's a more direct connection, and may work better, but it was also common to have non working AAAA records, so a delayed fallback is preferable to no fallback as used to be common.

hayyyyydos• 3 years ago

When helping someone over the phone, I get them to go to http://ipchicken.com

Very easy URL to relay, "do you see the chicken? let me know what the blue numbers are below it" - and most people seem to get a kick out of it!

dgl2• 3 years ago

A long time ago I spent a bit too long debugging something to later find out the "source port" that displays isn't right! It's still not right! I obviously fixed this by making my own site (https://ip.wtf).

pepa658• 3 years ago

Gives a CloudFlare 520 error for me...

pepa658• 3 years ago

And if you attach /ip you get only the IP address (as /api also includes the URL of the documentation).

ChrisArchitect• 3 years ago

This is a re-blog; Original post: https://news.ycombinator.com/item?id=27415537

ddrager• 3 years ago

Wow, I didn't realize the little article I wrote for Lifehacker would have such a big impact on this project. Also didn't realize he had passed on the project to Cloudflare. They're a great team so I'm happy it's in their capable hands now!

renewiltord• 3 years ago

It's funny that there are so many of these. I use

    curl ifconfig.me

jamesponddotco• 3 years ago

It's a fun project if you want to learn to code, which is why I think there're so many of them around. I built and run Accio127[1][2] for the same reason.

[1] https://api.accio127.com/v1/ip/

[2] https://git.sr.ht/~jamesponddotco/accio127

tetrep• 3 years ago

Indeed, it's like "hello, world!" but actually useful :)

brandonp0• 3 years ago

I made a site like this to mess with a guy at work. Everyone knew of IPChicken, and his last name is Herring, so I created IPHerring. I'd put Photoshopped images of him on the site for different holidays and coworkers always thought it was hilarious. They would even send me ideas of what to put next.

Now I sometimes use AI image generation tools to really make it stand out. It's been a lot of fun. A lot of the tech folks in my area are using it now.

prmoustache• 3 years ago

So you are proud of being a toxic coworker?

Snawoot• 3 years ago

Why not use protocols which are specifically designed to report mapped IP address like STUN? It's faster as UDP exchange is shorter than 3-way TCP handshake (or even TCP+TLS handshake).

Here is an implementation which uses parallel STUN queries to report address reliably as fast as possible: https://github.com/Snawoot/myip

msm_• 3 years ago

Nice tool! Looks like a great solution.

But unfortunately I don't have it in a random docker/kubernetes containers or random internal servers, and these are the contexts where I personally usually want to check my external IP. They usually have curl though.

seabass-labrax• 3 years ago

Maybe curl ought to support STUN (if it doesn't already). It's becoming a very common technology now that NAT is so prevalent.

diath• 3 years ago

Because one requires you to merely type a simple URL in your browser that you already likely have open, the other requires you to install Go, clone a git repo, compile the program, install the program, and THEN finally run the program.

justsomehnguy2• 3 years ago

... only to be blocked by the corporate firewall which doesn't allow anything besides tcp/80 and tcp/443.

tchbnl• 3 years ago

This is very cool and something that'd be neat to roll into a toolset. But I think you're missing the point of izanhazip. It's meant to be quick and easily accessible regardless of where you are or what system you're on (assuming there's curl or similar installed).

I might not have permission or it wouldn't be reasonable to install something. And I can link it to customers or give them a simple command to run, and all it returns is the actual info I need from them.

zie3• 3 years ago

For ridiculously easy things like this, I think it's smarter for you to just host it yourself. This way you are not forcing other people to carry your burden.

nginx config example:

  location /ip {
    add_header Content-Type "application/json";
    return 200 '{"host":"$server_name","ip":"$remote_addr","port":"$remote_port","server_ip":"$server_addr","server_port":"$server_port

"}\n'; }

Which will return something like this in JSON format:

    {"host":"www.example.org","ip":"199.200.200.14","port":"7990","server_ip":"199.200.100.229","server_port":"443"}

This is all done 100% within NGINX, and I include a lot of stuff you probably don't want or care about. Other web servers probably have similar capabilities.

nurettin• 3 years ago

I have something very similar, and all my projects depend on that. I also made a copy of httpbin which I host on a server. Useful for unit testing. And a gateway for hookback urls that I use for relaying/logging oauth and similar things to internal vpns. All very useful gadgets that have been running for over half a decade on arch.

turtlebits• 3 years ago

If it's on the public internet, you're not forcing anyone to provide you a service. Standing up reliable infra isn't easy nor free, no matter how trivial deploying it may be.

iknowstuff• 3 years ago

Probably more efficient to use https://lib.rs/hyper - and actually maintainable.

jesprenj3• 3 years ago

I can't say a thing about efficiency, but for maintainability, I have to disagree. This seems to be a rust library, and for maintaining that, you'd need to write a program, compile it every time some updates come by, rerun the recompiled program, ...

With the parent comment example, all you need is nginx, available as a package on all distros, and a single static config file. With an auto-updating package manager and a service manager, one never needs to write anything else apart from that static config file.

Or did you mean something else with "actually maintainable"?

Titan2189• 3 years ago

This will return the wrong results when used behind a load balancer

justsomehnguy2• 3 years ago

Anything would return proxy/LB address. So do not use it behind LB/proxy/NAT.

xereeto2• 3 years ago

Not if you use the PROXY protocol

linsomniac• 3 years ago

Ok, I'll bite... What kind of machine do you host this on that can handle 400,000 of these requests (with TLS mind you) per second? That was the load he mentions it handling in 2021, he stopped mentioning requests per day metrics after that.

BeefWellington• 3 years ago

400,000 req/s is actually not crazy. Back in the single-core era I was doing 1/10th of that on a production server for similar workloads a compiled VB / COM+ app. I would wager Nginx can handle that pretty easily on a modern dual or quad-core system.

hamandcheese• 3 years ago

I think you are misunderstanding... the point of self hosting is that you only need to handle your own load. It only needs to scale to what, 1 request per day?

noirscape2• 3 years ago

Wasn't the original target of nginx back in the nineties to hit 100k requests per second with less overhead than (at the time, standard) apache2?

With that in mind + the general advancing of hw since then, it wouldn't be too suprising if nginx could handle that load easily. It'd just get more difficult if you wanted to put anything else (ie. metrics) on that endpoint since afaict nginx doesn't have anything to monitor those things if you don't have the Enterprise version of their tools.

In any case you might be misreading the setup for the parent here - the recommendation is just that if you're doing this in the context of a webapp, that this sort of behavior is trivially easy to bounce back in JSON using nginx.

zie3• 3 years ago

No, the point is, you host it for your own needs, so you are not using their service. Your implementation is for YOUR needs. You can make it public or not and advertise it or not at your discretion. What we do is make it public, but don't advertise it at all. Our software just uses it when needed.

If your use case calls for 400k/reqs a second on what your IP is and you haven't yet figured out how to build out your infrastructure(or pay someone to do it for you), you have bigger problems than figuring our what your public IP is.

francislavoie• 3 years ago

Alternatively, with Caddy (with automated TLS, single static binary):

    example.com {
        handle /ip {
            header Content-Type application/json
            respond `{"host":"{host}","ip":"{remote_host}","port":"{remote_port}"}`
        }
    }

Though the usefulness of the host (client specified it), remote port (it's random), and server ip/port (it's static and not useful for the client) are questionable.

quickthrower2• 3 years ago

Useful for UA sanity checking I guess

anon7331• 3 years ago

Alternatively, search the web for everyone implementing "/ip" and random load balance between all of them and let them handle the load for you.

gaudat• 3 years ago

My favorite: https://cloudflare.com/cdn-cgi/trace

matthberg• 3 years ago

/cdn-cgi/trace isn't available on just cloudflare.com, it's on every site they proxy too (there might be a setting somewhere to disable it yet it's on by default). I've yet to figure out what happens if your site also serves something there, yet it was surprising to see on a barebones site I had routed through them.

I learned this from: https://news.ycombinator.com/item?id=36383258

1vuio0pswjnm75• 3 years ago

   sni=plaintext

There was a great trial CF ran for a long period with a previous version of encrypted SNI (now ECH). One could get encrypted SNI with any site using CF via modified OpenSSL. But they stopped this experiment. Meanwhile ECH was still not ready.

If anyone is getting something other than "sni=plaintext" for a CF domain besides crypto.cloudflare.com, then please let us know how.

zie3• 3 years ago

That's neat, but that's the opposite of what I'm suggesting. I'm saying if you are hosting web content anyway, then just host a /ip endpoint that returns the IP address. That way you aren't forcing other people to carry your load.

1vuio0pswjnm75• 3 years ago

Another one

https://whatismyip.akamai.com/advanced?debug

https://ipv4.whatismyip.akamai.com

DNS-based

   drill whoami.akamai.net

The second one might be useful to verify one is not using local, ISP-provided DNS, or to see whether a DoH provider effectively geolocates its users, e.g., Cloudflare.

sublinear• 3 years ago

Bad cert. The common name does not match the subdomain.

mr-karan• 3 years ago

Another DNS based one:

  dig ip @dns.toys +short

1vuio0pswjnm75• 3 years ago

Another one

Send a request to stackexchange.com or any of its subdomains without a user-agent header.

acidburnNSA• 3 years ago

Now I just need the apache config for this...anyone?

paravz• 3 years ago

great callout! A more advanced self hosted option can be https://github.com/mpolden/echoip

blibble• 3 years ago

if some AS is taking the piss: start returning random addresses just for them?

they'd soon learn

yardstick2• 3 years ago

Yeah I’m surprised this wasn’t attempted

cferry• 3 years ago

Not having to ask the public facing IP address of some NAT-performing router is one of the good sides of IPv6. I'm wondering what uses there are of such a service, besides dynamic DNS updates, that would need automated queries and result in such an overwhelming amount of traffic...

dfc4• 3 years ago

Slightly related: There used to be a DNS server that you could query a TXT record and the response would include the IP of the server that submitted the query. You could use it to debug DNS issues. I thought it was from DNS-OARC but I can't find it anywhere. Does anyone know a way to accomplish this?

erinnh4• 3 years ago

I don’t know of a server that does exactly what you wrote, but I generally troubleshoot dns issues with a few dig commands. dig without any parameters will resolve via your normal dns server and display the servers ip.

With @(dns server ip here) you can query a different dns server to check what their answer is.

With +trace you can go through the complete dns chain from the root servers on to check for issues in the chain.

Sorry if this doesn’t help you or you knew this already.

gavinsyancey• 3 years ago

dig +short TXT o-o.myaddr.l.google.com @ns1.google.com

dfc4• 3 years ago

This works! Thank you very much.

thenickdude• 3 years ago

I believe you're thinking of OpenDNS:

dig -4 +short myip.opendns.com @resolver1.opendns.com

jtokoph• 3 years ago

And the v6 version: dig -6 +short myip.opendns.com @resolver1.opendns.com aaaa

dfc4• 3 years ago

This only seems to work if your client can send requests directly to resolver1.opendns.com. It does not work if you have a server that is intercepting DNS or if you use the system configured DNS. The google version posted below is closer to what I was looking for:

    $ dig +short TXT o-o.myaddr.l.google.com @ns1.google.com
    "A.B.C.D"
    $ dig +short TXT o-o.myaddr.l.google.com
    "172.253.195.202"
    "edns0-client-subnet A.B.C.0/24"
    $ dig +short TXT o-o.myaddr.l.google.com @9.9.9.9
    "162.244.55.23"
    $ dig +short TXT o-o.myaddr.l.google.com @1.1.1.1
    "172.71.221.175"

The opendns implementation returns nothing if you try something similar to the last three.

p1mrx• 3 years ago

"https://myresolver.info/" was good while it lasted. It used stupid DNS tricks to show your resolver in the browser:

https://web.archive.org/web/20131126131155/https://ndkyez8kh...

mgbmtl• 3 years ago

You could write a program that listens on port 53, parses the query and returns the correct value?

DNS is hard to implement, but for responding to a very specific type of query, should be easy?

theblazehen• 3 years ago

In addition to the others, there is also https://www.dns.toys/

georgiop• 3 years ago

The amount of intel Cloudflare obtains from this would be staggering. Just the TLS signatures alone is a goldmine. Look at the CISCO mercury product and their TLS database with malware detection. Or how Akamai bought https://www.fingerbank.org/

You got the short end of the stick for $8 reimbursement!

yardstick2• 3 years ago

I used to use ipchicken and some others, but now I just type “what is my ip” into google and get it that way. Not suitable for automation but in my case it’s just a quick manual check.

blahyawnblah• 3 years ago

curl ipinfo.io or ipinfo.io/ip

kayodelycaon• 3 years ago

Ah Major Hayden. Great guy. I remember getting a crash course on system administration in Slicehost’s IRC channel because some idiot ran an ancient Java application server on an open port. We got hacked and I got volun-told to clean up the mess because I was the only person running Linux on my laptop.

Everyone was so nice and I learned so much. I owe them all a lot of drinks. :)

mhayden3• 3 years ago

Glad I could help. Hope you're doing well. I miss those Slicehost days.

jesprenj3• 3 years ago

Quite useful that it returns a newline after the IP address.

My similar setup with nginx (http://4a.si/ip) only returns $remote_addr without the newline, making it ugly for using with `curl`.

stuartd• 3 years ago

When I’m configuring flask on a random AWS server, `curl icanhazip.com` makes it easier and adds a little light to a boring task

RKearney• 3 years ago

AWS has an endpoint for this: http://checkip.amazonaws.com

arjvik4• 3 years ago

Saves a few milliseconds of transit at the expense of a few seconds of chuckling... not worth it :)

jokoon• 3 years ago

Those numbers are astronomical

So he did not solve that Chinese block?

No follow up?

makach• 3 years ago

what an amazing letter, thank you for your service!

icanhazip is part of internet lore, and passing it on to Cloudflare is a very noble thing to do! Cloudflare, please stay true to the idealistic principles of simplicity and availability for the service.

mhayden3• 3 years ago

You're welcome! It was a fun ride with plenty of failures to learn from. ;)

SergeAx2• 3 years ago

Earlier today, I talked with my ex-colleague about things being bloated and unnecessarily complicated in software. Here we have a perfect example.

  $ curl -v icanhazip.com

  > GET / HTTP/1.1
  > Host: icanhazip.com
  > User-Agent: curl/8.2.1
  > Accept: */*

curl is being curl here: protocol, host, shortest possible user-agent string, nothing extra. Let's see the reply:

  < HTTP/1.1 200 OK

Okay.

  < Date: Tue, 01 Aug 2023 06:59:21 GMT

I am not sure, is it really necessary? I will use NTP if I need to know the current GMT. RFC doesn't state this header as mandatory.

  < Content-Type: text/plain
  < Content-Length: 14

Okay, nice to know.

  < Connection: keep-alive

Really? What's a use case here? Do I need to be reminded of my IP again in a few seconds? Or is it in case my IP will quickly change? Oh, never mind...

  < Access-Control-Allow-Origin: *
  < Access-Control-Allow-Methods: GET

Now, this is a bit ridiculous. Why would the fetch-based browser app rely on a third-party service to determine the client's IP?

  < Set-Cookie: [250 bytes of total abomination]

Why, oh why? Why do I need to receive this and keep it somewhere? All I want is to haz IP! Can I only haz IP?

  < Server: cloudflare

Okay, a little vanity never killed nobody.

  < CF-RAY: 7efc32adfef5c21e-VIE

I know what Cloudflare Ray is. The question is: why do I need it here?

  < alt-svc: h3=":443"; ma=86400

Good to know, maybe, but to be honest - this is redundant too.

  xxx.xx.xx.xx [my IP address, masked for privacy reasons]

At last! Now I can do my thing with the IP I just haz.

I will not rant here about extra bytes transferred, extra bandwidth congested, extra electricity burned, and so on. Sapienti sat. Two side notes: it replies with HTTP 1.1 on HTTP 1.0 request, and it still puts alt-svc header into https reply.

I rest my case.

thefz• 3 years ago

Just use plain curl and all you are getting is the IP.

It was conceived this way to be used in scripts. I don't see why you might want to -v here except to prove a non existing point that you made up.

SergeAx2• 3 years ago

Because I was interested in the whole response, not it's text/plain part. All those headers are still there, even if I don't use them.

xereeto2• 3 years ago

You do know headers are transferred whether you look at them or not, right? A request to icanhazip.com results in a response that is 90% completely wasted bandwidth.

bloqs• 3 years ago

Im so glad the late 00s era of cringy "lolcat english" is over. Perhaps the modern equivalent of excessively pretentious sounding crypto bro naming schemes is worse in some ways, but at least I dont have to pause to explain the name when I say it out aloud to someone.

denton-scratch• 3 years ago

I see no amusing request headers. I guess Cloudflare dropped them.

erubin• 3 years ago

if all the traffic is abusiveness why keep running the service

Yeri• 3 years ago

Using cloudflare workers you can host your own[1]:

``` addEventListener("fetch", event => { event.respondWith(handleRequest(event.request)) })

async function handleRequest(e) { const connectingIP = e.headers.get("cf-connecting-ip"); return new Response(`${connectingIP}\n`, {status: 200}) } ```

[1]: formatting gets messed up: https://pastebin.com/gSysKd5k

hfkwer• 3 years ago

It's sad to think that everyone had to work so hard to solve a problem whose solution is 27 years old. One day we'll just be able to run `ip -6 addr show scope global` and get the correct answer without wasting everyone's bandwidth and compute.

zzo38computer• 3 years ago

I use icanhazip. It is good; just the plain IP address, no HTML and no JSON. It could be done even simpler by just nc to a specified host and port and no HTTP is needed either; it need not wait for a request and will not need response headers.

I made a shell script with:

  curl -s 'http://icanhazip.com/' | cat -v

Icanhazip: A simple IP address tool survived a deluge of users (2021)

Related Stories