Geocheck: Five IP checks in one command — a breakdown of the report

Proxy and Virtual Private Networks
, , , ,
1

geocheck: one command and a complete portrait of your IP
geocheck: one command and a complete portrait of your IP1280×670 34.8 KB

Remnawave has released geocheck — a utility that checks your exit point with a single command: what the address looks like, where you are geolocated, how straight the traffic goes, and which services will open. Version v0.3.0 from August 18, MIT license.

Geocheck report: address reputation, opinion of forty services about the country, connectivity checks and service availability
Demo from the project documentation

Getting started

# the fastest way — the launcher will choose Docker, Podman or a binary for you
curl -fsSL https://geocheck.ing | sh

# directly via Docker
docker run --rm -it --network host remnawave/geocheck:ing

# build from source
go install github.com/remnawave/geocheck/cmd/geocheck@latest

Flags for the launcher are passed after -s --, for example curl -fsSL https://geocheck.ing | sh -s -- -4 --detail.

Warning:

--network host is mandatory. Without it, measurements will go through the Docker bridge and will show not your gateway, but the container’s internal network.

For traceroute by hops you need raw sockets. In Docker they are provided by default; for Podman add --cap-add=NET_RAW, for the Linux binary — sudo setcap cap_net_raw+p ./geocheck, on macOS — run with sudo. Without this the utility will run but only show the delay to the target, without intermediate hops.

What’s in the report

Five blocks, each can be disabled with its flag:

  • Address reputation — data center or residential, whether it’s VPN/proxy, risk assessment. Disable with --no-reputation.
  • Geolocation — about 40 GeoIP services and where they disagree. Disable with --no-geo.
  • Connectivity — the same checks your OS uses: Google, Apple, Microsoft. Detects captive portals. Disable with --no-portal.
  • Path — traceroute to major networks, each hop labeled with AS number. Disable with --no-mtr.
  • Service availability — Netflix, ChatGPT, Gemini, NotebookLM, YouTube Premium, Claude, TikTok. Disable with --no-access.

Route verdicts

Path analysis: verdict, latency, losses, hop count and the final autonomous system for each target
Path analysis block, demonstration from the project documentation

The most useful part of the report. For each target a verdict is issued:

Path verdicts
Path verdicts1280×700 53.2 KB

Wording — from geocheck documentation

Important:

How to read this. transit on a cheap VPS is normal. detour where the route should be short is an extra limb: a tunnel over a tunnel or exit not where you thought. intercepted — you did not reach the destination, the intermediary responded.

Useful commands

# check your SOCKS5 — report from your user perspective
geocheck -p 127.0.0.1:10808

# check a specific interface or address
geocheck -i wg0
geocheck -i 203.0.113.10

# only IPv4 or only IPv6
geocheck -4
geocheck -6

# only the path, without querying external services
geocheck --no-geo --no-access --no-reputation

# full hop table
geocheck -d

# select targets: default, web, video, dns, cdn, social, messaging,
# cloud, ai, dev, gaming, google, telegram, all
geocheck -T telegram,ai

# see what the report looks like, without sending anything out
geocheck --demo

# as an image — convenient to post in chat or ticket
geocheck --svg report.svg

Flag -p HOST:PORT is the main reason to keep the utility handy. You set up a local Xray or sing-box client, point geocheck to its SOCKS5 port and see the report through the eyes of someone who travels through you. More precise than opening “what is my IP” in a browser.

For scripts there is -j:

# targets where the route ended up indirect
geocheck --json | jq '.connectivity.targets[] | select(.verdict != "direct") | {name, verdict, rtt_ms}'

# summary of address reputation
geocheck --json | jq '.reputation | {type, risk, flags}'
Security:

A full run sends your IP to around forty third-party GeoIP services plus the Google, Apple and Microsoft check points. Otherwise such a report can’t be collected, but it’s worth knowing.

The --mask flag is described as “mask the public address in the output” — it hides the address in the output but does not prevent it from going out. It’s fine for screenshots, not for privacy.

The project is a matter of days old, so the set of checks and the output format will still change. For one-off diagnostics this doesn’t matter, but tying monitoring to a JSON schema is still premature.

Related: three commands to diagnose MTU and MSS and your own SOCKS5 on a bare server — the very proxy for flag -p.

Question:

Who has tried this on their servers — what verdicts did you get? Especially interested in detour and intercepted: on which targets did they appear and why?

Sources