Skip to content

How to find your egress IP⚓︎

When Maven Central asks for your egress IP, they mean the outbound IP address that Maven Central sees when your builds make requests — not the IP of your laptop or workstation.

These are often different things. If your builds run through a corporate NAT gateway, a cloud NAT, a VPN, or a repository manager, the IP that appears in Maven Central's logs is the outbound IP of that infrastructure — not the machine where you typed a command.

The simple case: direct connection, no proxy⚓︎

If your builds connect directly to Maven Central without a repository manager or proxy in the path, you can find the IP with a plain curl:

curl -sL https://repo1.maven.org/cdn-cgi/trace

Look for the ip= line in the output. That is the IP Maven Central sees.

For remote builds, CI environments, and proxied setups⚓︎

curl run from a workstation measures the wrong thing when builds go through a repository manager. The repository manager talks to Maven Central on behalf of your builds — so its outbound IP is the one in Maven Central's logs, not yours.

The correct approach is to run the IP check from inside the same network path as your builds, using the same Maven resolver and the same proxy settings.

Maven Central provides a diagnostic artifact for this. When Maven fetches it, the fetch travels through whatever proxy or mirror your builds use, and the response contains the egress IP as Maven Central sees it.

Quick commands (no POM changes required)⚓︎

Run these from a CI agent or build server — not a local workstation:

# Use today's date as the version string (it's a cache key — any unused string works)
mvn dependency:get  -Dartifact=com.sonatype.central.whoami:trace:2026-09-18:txt -Dtransitive=false
mvn dependency:copy -Dartifact=com.sonatype.central.whoami:trace:2026-09-18:txt -DoutputDirectory=target

The trace file lands in target/trace-2026-09-18.txt. Open it and look for the ip= line.

Expected warnings

You will see two [WARNING] lines during resolution. These are harmless and expected:

  • The POM for com.sonatype.central.whoami:trace ... is missing, no dependency information available
  • Checksum validation failed, no checksums available

Maven resolves the artifact successfully despite these warnings.

Standalone POM (when you cannot touch your real build)⚓︎

Drop this pom.xml in an empty directory, then run mvn -U package. The trace lands in target/whoami/.

Run it from the build environment you want to measure — a CI agent, build server, or the machine behind your repository manager — not from your laptop.

<?xml version="1.0" encoding="UTF-8"?>
<!--
  Maven Central egress-IP diagnostic.

  Run:  mvn -U package
  Then: send the target/whoami/trace-*.txt file to Sonatype support.

  IMPORTANT: run this from the build environment you want measured, not a laptop.

  The version below is only a cache key and has no meaning. Change it to today's
  date to force a fresh reading. A version you have already fetched will be served
  from cache.

  Two [WARNING] lines are EXPECTED and harmless:
    "The POM for com.sonatype.central.whoami:trace ... is missing"
    "Checksum validation failed, no checksums available"
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.example.diagnostics</groupId>
  <artifactId>maven-central-whoami</artifactId>
  <version>1.0-SNAPSHOT</version>
  <packaging>pom</packaging>

  <dependencies>
    <dependency>
      <groupId>com.sonatype.central.whoami</groupId>
      <artifactId>trace</artifactId>
      <version>2026-09-18</version>
      <type>txt</type>
    </dependency>
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <version>3.7.0</version>
        <executions>
          <execution>
            <id>whoami</id>
            <phase>package</phase>
            <goals><goal>copy-dependencies</goal></goals>
            <configuration>
              <outputDirectory>${project.build.directory}/whoami</outputDirectory>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</project>

Reading the output⚓︎

The trace file is plain text. The key fields:

  • ip= — the egress IP as Maven Central sees it. This is the value to provide to support.
  • uag= — the user agent. If it names a repository manager (e.g. Nexus/3.x), the trace measured the proxy's egress IP, which is the correct answer for a proxied environment.

Run it more than once⚓︎

Egress is often a pool of IPs, not a single address. A single run proves an IP your environment uses, not the only one. Run the command several times using different version strings (each new version forces a fresh fetch past the cache), and ideally from more than one build agent. Provide all the IPs you see.

Limitation: if your IP is already blocked⚓︎

If your IP is currently blocked, Maven Central returns a 403 before checking the path, so this tool cannot be run from a blocked address. In that case, contact your network or cloud team for the NAT gateway or egress IP directly, or check your cloud provider's console for the outbound IP of the affected environment.