1

I have created and stopped couple of GCP instances to collect network latency & bandwidth stats. I have public ip addresses of them but I lost the mapping file due to laptop crash. Is there a way to map ip address to region in GCP?

Say 35.243.94.242 to Region Japan.

2
  • I'm guessing You used ephemeral ip's and now trying to guess which zone the IP were assigned to - right ?
    – Wojtek_B
    Dec 18, 2019 at 9:20
  • If Default option for IP is ephemeral, Yes.
    – Genie
    Dec 18, 2019 at 9:22

3 Answers 3

1

You can reserve public ip based on regions- Go to Reserve a static address

for more info - https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address

2
  • Given suggestion works for running instances. My case is instances are stopped already.
    – Genie
    Dec 18, 2019 at 9:14
  • 1
    if stopped vm created with ephemeral then this will not work. but if you create reserve ip, assign to vm and then stop vm will work. Dec 18, 2019 at 9:25
1

If you used default settings for VM's and just changed the region you can't tell GCP regions based by IP's.

Google has many IP range blocks available but those IP's are assigned to many regions. There's a ton of GCP documentation but it just gives you some clues. Similar case was discussed also on StackOverflow.

There's a way to determine what those IP ranges are exactly but the're not in any way "mapped" to regions.

If you try to geo-locate IP - you will (in most cases) end up finding "Mountain View, California" (because they're owned by Google).

You also can't do traceroute to precisely figure out where those IP's are because of Google's security policy - they obscure results by increassing TTL time of the packet when they leave VM's.

Using traceroute doesn't even get you an idea which continent the packets are going to. I've tried to traceroute my VM's (in 4 different zones) and the results were very bizarre aside from this last part of route being obscured by Google.

If you didn't spend a whole day on researching the latency times just make the experiment again. That way you will be sure you got it right.

1

The approach below could work if VM instances have been accessed via HTTP.

Back in the 2014, Gary Ling, a GCP Product Manager, explained at Google Groups how public addresses are being handled:

"We are aware of this issue that (almost) all Google IP addresses are SWIP'ed to be Mountain View, CA. And at Google, it's not uncommon to remap a block of IPs from one location to another, especially given the elasticity of IP addresses for the Cloud. Too bad that many of external Geo IP services solely depend on SWIP database. While we are evaluating what we can do to help our customers, your best bet in my opinion is contacting your API provider and explore options they may offer now."

That means that till an External IP is configured as the Standard (regional) type, it is impossible to obtain the VM instance location based on the address.

In this situation the fact that VM instance itself is bound to a Zone can help to restore lost bindings retrospectively.

Unfortunately GCP Logging does not save information about External IP address binding, in contrast with the Internal IP. In addition, when a VM instance is stopped, this information gets lost in the Compute Engine configuration.

Fortunately this information can be obtained from the web server access log. In case you stopped and then started VM instance, it would lose its Ephemeral External IP and get a new one. Hence you would need to request information about both addresses the VM instance has had.

Go to the Logs Viewer and switch it to the new version view:

GCP Navigation Menu => Stackdriver => Logging => Logs Viewer => Classic => Preview the new Logs Viewer

Enter and run a query like this:

timestamp>="2019-12-18T16:55:55.671Z"
"GET"
"35.246.254.65" OR "35.198.96.135"

or use gcloud command line in CloudShell (preparation steps are provided for your convenience):

$ gcloud config list 
$ gcloud config set account 'account'
$ gcloud config set core/project 'project_id'
$ gcloud logging read 'timestamp>="2019-12-19" AND "GET" AND "35.246.254.65" OR "35.198.96.135"'

You will see log entries from the web server access log (Apache in this example) that contain the External IP of the VM instance, its ID, zone and name as the values textPayload, instance_id, zone and compute.googleapis.com/resource_name respectively. In the example below the information is retrospectively restored from logs that mentions the ephemeral External IP 35.246.254.65 was bound to the VM instance ssh2 in the region europe-west3:

{
  "textPayload": "104.132.189.65 - - [19/Dec/2019:12:36:34 +0100] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://35.246.254.65/" "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"",
  "insertId": "46bi50g2tl8r4c",
  "resource": {
    "type": "gce_instance",
    "labels": {
      "project_id": "myworks2",
      "instance_id": "8445465273187245258",
      "zone": "europe-west3-c"
    }
  },
  "timestamp": "2019-12-19T11:36:35.006315576Z",
  "labels": {
    "compute.googleapis.com/resource_name": "ssh2"
  },
  "logName": "projects/myworks2/logs/apache-access",
  "receiveTimestamp": "2019-12-19T11:36:36.253027441Z"
}

This works both for the Ephemeral and Static External IP, and, what's important, it remains in the Stackdriver logs even after the VM has been deleted.

The output of the query could be huge. It is up-to-you to process the output with the --format or --flatten command line parameters or any parsing script as needed.

$ gcloud logging read 'timestamp>="2019-12-19" AND "GET" AND "35.246.254.65" OR "35.198.96.135"' --format="table(labels.'compute.googleapis.com/resource_name',resource.labels.instance_id,resource.labels.zone,textPayload)"
COMPUTE.GOOGLEAPIS.COM/RESOURCE_NAME  INSTANCE_ID          ZONE            TEXT_PAYLOAD
ssh2                                  8445465273187245258  europe-west3-c  104.132.189.65 - - [19/Dec/2019:12:56:56 +0100] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://35.198.96.135/" "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"
ssh2                                  8445465273187245258  europe-west3-c  104.132.189.65 - - [19/Dec/2019:12:36:34 +0100] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://35.246.254.65/" "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"

Please see the following links for more advanced query examples:

Advanced logs queries

Filtering and formatting fun with gcloud, GCP’s command line interface

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .