Nebula utilizes a 3rd party IP lookup service to determine the device location by making API calls. This information is anonymized to a 25-mile radius for privacy reasons. The accuracy is expected to be within 99% on a country level, and around 60% on a city level for the United States.
The endpoint's location is displayed on the Manage > Endpoints page with the City, Country, and Region columns.
To show these columns on the page, click Add / Remove in the top-right. For more information, see Manage endpoints in Nebula.
Endpoint location discrepancies
If the location in the console is inaccurate, it may be due to one of the following factors:
- The endpoint is behind a Virtual Private Network (VPN).
- The endpoint is a mobile device or connecting via a mobile hotspot.
- The Internet Service Provider's (ISP) internet exchange point is at a different location.
- The firewall or ISP is using backup ISP lines or Border Gateway Protocol (BGP) for internet redundancy.
If you believe that the location displayed in your console is different than the actual location and none of the reasons above are applicable to your environment, reach out to Support to assist with reviewing the discrepancy.
Perform a traceroute
Support may request you to perform a traceroute from two endpoints with different public IP addresses on the same local network. A traceroute allows you to follow the path that packets take to arrive at the destination site. You can compare this between your endpoints to identify issues in network routing.
- Open Command Prompt as an administrator.
- Use the tracert command to perform a traceroute to the destination site. For example,
tracert www.threatdown.com
- Press Enter.