IP geolocation is the process of finding the geographic locations of Internet hosts. We will focus on Internet hosts in metropolitan area network(MAN). The Internet hosts will be under the same Internet service provider(ISP). Machines in close geographic distance will share almost identical network infrastructure due to having the same ISP. We propose two MAN IP geolocation techniques that are based on wavelets, e.g. wavelet density estimation and wavelet time-frequency analysis.

Wavelet density estimation looks for similarity among RTT distributions of

nearby machines. To achieve this, wavelet density estimation utilizes wavelets as orthonormal basis in L2(R) to construct estimated probability density functions(pdfs) of RTT distributions. A symmetrized version of Kullback-Leibler divergence is devised to measure the similarity between two estimated pdfs. The second technique, wavelet time-frequency analysis, explores a common pattern in frequency content evolutions over time of the RTT sequences of nearby machines. Wavelet time-frequency analysis employs wavelets to analyze frequency contents of RTT sequences over short time-intervals. Sudden rises of frequency content in RTT sequences can then be detected. We evaluate the performance of these two MAN IP geolocation techniques with data sets collected from our testbed. With these data sets, we analyze the effects of RTT sample size, RTT probing rate and landmark distribution to the performance of the techniques.