Can you approximate a server's location?

Me and a colleague are having an argument whether or not the SaaS application we use is hosted in the US or in the EU.

• The contract says EU.
• Various traceroutes (example from home below) say US.

In the example below, the lookup of both 4.59.145.42 and the end 199.15.. say they're located in the US. Web based traces from Argentina and Hong Kong also go to the US backbone.

I am inclined to believe the traceroute, but I want to be sure. Is there ANY way that this server can be located in the EU?

 1  fritz.box (192.168.*.*)  3.030 ms  2.583 ms  1.234 ms
 2  lo0.dr13.d12.xs4all.net (194.109.5.212)  18.564 ms  141.379 ms  17.804 ms
 3  1323.ae3.xr3.3d12.xs4all.net (194.109.7.141)  16.790 ms  134.837 ms 16.450 ms
 4  0.ae2.xr4.1d12.xs4all.net (194.109.5.82)  15.918 ms  138.149 ms  156.167 ms
 5  asd2-rou-1043.nl.eurorings.net (134.222.93.144)  15.998 ms  138.796 ms  130.165 ms
 6  ae9.edge3.amsterdam1.level3.net (213.244.164.205)  17.495 ms  136.072 ms  17.150 ms
 7  * * *
 8  4.59.145.42 (4.59.145.42)  101.048 ms  100.554 ms  99.881 ms
 9  199.15.*.* (199.15.*.*)  103.954 ms  103.741 ms  103.530 ms

As BillP3rd mentioned in his comment, "Technically, it could be located literally anywhere, regardless of what TRACEROUTE says. All you can know for sure is where the path from the Internet ends."

Now for the most part we only care where the path from the internet ends because that's where your traffic is going. However it's not a 100% guarantee the physical data is stored there, but at the very least does confirm the location of the server you are connecting to.

Since you've hidden the actual destination IP address, we cannot pinpoint it. But it is most certainly in the U.S..

Evidence supporting this (none of these should be conclusive on their own):

• The entire 199.0.0.0/8 block is an ARIN block. Source: ARIN
• Based on traceroute data 4.59.145.42 is in the U.S. East coast NYC area. Source: Your traceroute (And mine)
• Based on routing data all IP blocks in the 199.15.x.x range are situated in the U.S. Source: HE.net LG
• Based on your traceroute the destination IP is within ~3ms of 4.59.145.42 Source: Your traceroute

You can never be sure when it comes to traceroute results. But there is hope for your special case.

The contract says the servers are in the EU. There is a test you can execute which, if successful, would give you 100% guarantee that they are lying. (if unsuccessful, they might be telling the truth, or they might be lying)

The idea is to use something like ping to measure the response time. Since you are using SaaS, it might not be enough to just ping the server. Maybe you want to have something where the software responds.

Now comes the tricky part.

You need to execute this ping from a machine which is located in the US. You need to be sure that this machine is in the US!

If you get a ping which is lower than 50ms, then you can be 100% sure the server is not in the EU. If you get a ping lower than 120ms, the server is likely not in the EU.

But why? The answer is: physics. The distance between US and Europe is so long that a signal traveling at the speed of light through fiber would need ~25ms for the trip (see WolframAlpha). Since ping measures two trips (host-server-host), a ping from the US to Europe needs at least 50ms.

But it gets better: the fastest cable between the two continents has ~60ms delay. So a ping below 120 indicates that the server is probably in the US.

There is no definitive way to prove where a server is hosted, short of hacking the connection to the source computer (which i highly DON'T recommend).

Hiding your IP Address is something that even most teenagers have learned to do to skirt security. The company COULD be using a security software that obscures their actual IP (for protection against would-be cyber-criminals), they could be using a proxy, or any number of other possibilities.

The easiest way to find out for sure is to call up a service rep, show them the proof, and see what they say. Then, you can win the bet with your friend, as internal conspiracies are void when it comes to bets, so whatever the company says should suffice :)