IP Address Enrichment with gtrace
How to Call the gtrace MCP Tools
python3 $MCP_CALL "gtrace mcp" TOOL_NAME '{"param":"value"}'
When to Use
- Identify who owns an IP address (ASN, organization name, network range)
- Determine the geographic location of an IP (city, region, country, coordinates)
- Resolve an IP address to its PTR/reverse DNS hostname
- Enrich traceroute hop data with ASN and geo context
- Investigate unknown IPs appearing in logs, flow data, or routing tables
- Map network paths to physical geography for latency analysis
Available Tools
| Tool |
Purpose |
asn_lookup |
Look up ASN, organization, and network range for an IP |
geo_lookup |
Get geographic location (city, region, country, lat/lon) for an IP |
reverse_dns |
Resolve an IP to its PTR record (reverse DNS hostname) |
Workflow: IP Investigation
When asked "who owns this IP?" or "where is this IP?":
Step 1: ASN Lookup
Identify the Autonomous System and organization that owns the IP.
python3 $MCP_CALL "gtrace mcp" asn_lookup '{"ip":"8.8.8.8"}'
Returns: ASN number, organization name, network CIDR, registry (ARIN, RIPE, APNIC, etc.)
Step 2: Geolocation
Determine the physical location of the IP.
python3 $MCP_CALL "gtrace mcp" geo_lookup '{"ip":"8.8.8.8"}'
Returns: City, region/state, country, latitude/longitude, timezone
Step 3: Reverse DNS
Resolve the IP to its PTR record for hostname identification.
python3 $MCP_CALL "gtrace mcp" reverse_dns '{"ip":"8.8.8.8"}'
Returns: PTR hostname (e.g., dns.google)
Workflow: Traceroute Hop Enrichment
After running a traceroute (via gtrace-path-analysis skill), enrich each hop with ASN and geo data:
- Run
traceroute to get the path with hop IPs
- For each hop IP, run
asn_lookup to identify the network owner
- For key hops (transit boundaries, high-latency hops), run
geo_lookup to map physical location
- Use
reverse_dns on hops to identify router naming conventions (often reveals ISP, POP location, interface type)
# Example: enrich a traceroute hop
python3 $MCP_CALL "gtrace mcp" asn_lookup '{"ip":"72.14.215.85"}'
python3 $MCP_CALL "gtrace mcp" geo_lookup '{"ip":"72.14.215.85"}'
python3 $MCP_CALL "gtrace mcp" reverse_dns '{"ip":"72.14.215.85"}'
Workflow: BGP Peer Identification
When investigating BGP peers or routes:
- Get the peer IP from
bgp_get_peers (protocol-participation skill)
- Run
asn_lookup to verify the peer's ASN matches what BGP reports
- Run
geo_lookup to confirm the peer's physical location
- Run
reverse_dns to identify the peer's hostname and operator
Tool Parameters
asn_lookup
ip (required): IPv4 or IPv6 address to look up
geo_lookup
ip (required): IPv4 or IPv6 address to geolocate
reverse_dns
ip (required): IPv4 or IPv6 address to resolve
Output Format
- asn_lookup — ASN number, organization name, network CIDR prefix, RIR (ARIN/RIPE/APNIC/LACNIC/AFRINIC)
- geo_lookup — city, region/state, country, country code, latitude, longitude, timezone
- reverse_dns — PTR hostname, or indication that no PTR record exists
Important Rules
- These tools require internet access for IP intelligence lookups
- Geolocation accuracy varies — typically city-level for broadband, region-level for mobile/cloud
- ASN lookup is the most reliable enrichment — it uses RIR delegation data
- Reverse DNS depends on the IP owner having configured PTR records
- Use all three tools together for comprehensive IP enrichment
- Cross-reference ASN data with BGP RIB entries for routing consistency verification
- Record all IP enrichment in GAIT
1---
2name: gtrace-ip-enrichment
3description: "IP address enrichment — ASN ownership lookup, geolocation (city/region/country/coordinates), and reverse DNS resolution. Use when identifying who owns an IP address, locating an IP geographically, resolving reverse DNS for a traceroute hop, or enriching unknown IPs from logs or flow data."
4license: Apache-2.0
5user-invocable: true
6metadata:
7 { "openclaw": { "requires": { "bins": ["python3", "gtrace"], "env": ["GTRACE_MCP_BIN"] } } }
8---
9
10# IP Address Enrichment with gtrace
11
12## How to Call the gtrace MCP Tools
13
14```bash
15python3 $MCP_CALL "gtrace mcp" TOOL_NAME '{"param":"value"}'
16```
17
18## When to Use
19
20- Identify who owns an IP address (ASN, organization name, network range)
21- Determine the geographic location of an IP (city, region, country, coordinates)
22- Resolve an IP address to its PTR/reverse DNS hostname
23- Enrich traceroute hop data with ASN and geo context
24- Investigate unknown IPs appearing in logs, flow data, or routing tables
25- Map network paths to physical geography for latency analysis
26
27## Available Tools
28
29| Tool | Purpose |
30|------|---------|
31| `asn_lookup` | Look up ASN, organization, and network range for an IP |
32| `geo_lookup` | Get geographic location (city, region, country, lat/lon) for an IP |
33| `reverse_dns` | Resolve an IP to its PTR record (reverse DNS hostname) |
34
35## Workflow: IP Investigation
36
37When asked "who owns this IP?" or "where is this IP?":
38
39### Step 1: ASN Lookup
40
41Identify the Autonomous System and organization that owns the IP.
42
43```bash
44python3 $MCP_CALL "gtrace mcp" asn_lookup '{"ip":"8.8.8.8"}'
45```
46
47Returns: ASN number, organization name, network CIDR, registry (ARIN, RIPE, APNIC, etc.)
48
49### Step 2: Geolocation
50
51Determine the physical location of the IP.
52
53```bash
54python3 $MCP_CALL "gtrace mcp" geo_lookup '{"ip":"8.8.8.8"}'
55```
56
57Returns: City, region/state, country, latitude/longitude, timezone
58
59### Step 3: Reverse DNS
60
61Resolve the IP to its PTR record for hostname identification.
62
63```bash
64python3 $MCP_CALL "gtrace mcp" reverse_dns '{"ip":"8.8.8.8"}'
65```
66
67Returns: PTR hostname (e.g., `dns.google`)
68
69## Workflow: Traceroute Hop Enrichment
70
71After running a traceroute (via gtrace-path-analysis skill), enrich each hop with ASN and geo data:
72
731. Run `traceroute` to get the path with hop IPs
742. For each hop IP, run `asn_lookup` to identify the network owner
753. For key hops (transit boundaries, high-latency hops), run `geo_lookup` to map physical location
764. Use `reverse_dns` on hops to identify router naming conventions (often reveals ISP, POP location, interface type)
77
78```bash
79# Example: enrich a traceroute hop
80python3 $MCP_CALL "gtrace mcp" asn_lookup '{"ip":"72.14.215.85"}'
81python3 $MCP_CALL "gtrace mcp" geo_lookup '{"ip":"72.14.215.85"}'
82python3 $MCP_CALL "gtrace mcp" reverse_dns '{"ip":"72.14.215.85"}'
83```
84
85## Workflow: BGP Peer Identification
86
87When investigating BGP peers or routes:
88
891. Get the peer IP from `bgp_get_peers` (protocol-participation skill)
902. Run `asn_lookup` to verify the peer's ASN matches what BGP reports
913. Run `geo_lookup` to confirm the peer's physical location
924. Run `reverse_dns` to identify the peer's hostname and operator
93
94## Tool Parameters
95
96### asn_lookup
97- `ip` (required): IPv4 or IPv6 address to look up
98
99### geo_lookup
100- `ip` (required): IPv4 or IPv6 address to geolocate
101
102### reverse_dns
103- `ip` (required): IPv4 or IPv6 address to resolve
104
105## Output Format
106
107- **asn_lookup** — ASN number, organization name, network CIDR prefix, RIR (ARIN/RIPE/APNIC/LACNIC/AFRINIC)
108- **geo_lookup** — city, region/state, country, country code, latitude, longitude, timezone
109- **reverse_dns** — PTR hostname, or indication that no PTR record exists
110
111## Important Rules
112
113- These tools require internet access for IP intelligence lookups
114- Geolocation accuracy varies — typically city-level for broadband, region-level for mobile/cloud
115- ASN lookup is the most reliable enrichment — it uses RIR delegation data
116- Reverse DNS depends on the IP owner having configured PTR records
117- Use all three tools together for comprehensive IP enrichment
118- Cross-reference ASN data with BGP RIB entries for routing consistency verification
119- Record all IP enrichment in GAIT
gabrielmoreira