Hi all,
Can any of you please recommend some IP-to-geo mapping database / web service ?
I would like to get resolution down to city if possible.
Thanks and Regards,
-ashe
Date: Mon, 15 May 2006 09:35:47 -0700
From: Ashe Canvar
Can any of you please recommend some IP-to-geo mapping database / web
service ?I would like to get resolution down to city if possible.
Many people would.
Don't hope for much better than country granularity -- and even _that_
frequently is incorrect.
Try the ".zz.countries.nerd.dk" DNS zone for a quick-and-easy source.
Disclosure: I'm not affiliated in any way, other than that I use it.
Eddy
<cough> scam_snake_oil_etc </cough>
The gold standard is MaxMind GeoIP. http://www.maxmind.com/
There are a couple "free" ones I've seen, but they are quite a bit
less accurate. I can't think of them off the top of my head.
As a major caveat, all geolocation services do have some degree of
inaccuracy, because the sources of data are very diverse. (Some ISPs
provide complete subnet maps to MaxMind and other providers, whereas
some data is scraped from WHOIS or provided by inference from
end-users.)
How so?
-M<
I'm not quite comfortable with the idea of building a market audience
based on data with at best dubious accuracy.
Quova seems to be the premier service: http://www.quova.com/
I read a story on them some time ago and I was left with the impression that
all the other players are rookies, but then again, you probably will pay
heavily for this service.
Geobytes is another one I've played with.
We're a small ISP, and I know they've never asked for our ranges, so the
best any of these could do would be on a multi-county basis. For kicks I
would like to try an IP address from each of our subnets and see how they
do.
Frank
It works for spammers.
- billn
Thanks for all your replies. I came across
http://www.hostip.info/use.html, which looks good, at least from a
API/ ease of use prespective.
So how would the illustrious people on nanog solve the folowing issue:
+ PHB walks into my office and asks for a global distribution of my
500K customers.
+ Preferably wants a gigantic world map with realtime visualization of
where the currently active customers are
I can solve the visualization part and the GIS issues. But comes down
to the accuracy of the geo-ip database in the end.
-ashe
Well,
I'm sure that everybodies here understand that the city databases cannot be accurate more than 50%.
The way we disperse static IP on commercial accounts there is not way they can figure out where the destination is.
The last best guest will be the peer router before my routers.
For me the country db is good enought for basic webalizer report for the customers websites.
(This way my customers dont waste queries to countries.nerd.dk on non-spam related things)
Have fun...
Bill Nash wrote:
IP location services are a niche service, they won’t work in the broad sense of things. Sites that need to make lawyers happy, such as MLB.com will work well with IP location services. MLB.Com basically says they won’t broadcast Dodger home games in the LA area on their website. (Or any team in their home market) Obviously there are ways to hide your location, but as long as the services offers reasonable results there will be demand for these services. Remember most of these IP location services were originally founded for advertisting reasons, not anti-fraud.
Kevin
Certainly explains all the Turkish spam I get, what with me being
just outside Ankara and all.
That's likely because they are attempting to do some sort
of location analysis themselves and have limited data to
work with. Spammers are generally not stupid. They are cheap
since their ability o generate revenue is randomized based on
the exploit of the day, so to speak. Targeting you with Turkish
ads is probably a combination of being cheap and someone possibly
stupid. Anyhow...before this thread turns into the debacle of
incorrect information that the NTP one did --
Typically, an ip address is analyzed by using multiple sources of data.
An attempt is made at a "triangulation" of sorts with both
good and bad bits compared. As the good bits build the confidence
factor in the triangulation rises. So you could have 2 pieces of
info that do correlate, bring in the whois record, no correlation
with that, and then toss it and bring something else in. Whois
accuracy is not a factor here.
Geo location isn't perfect, but it's not "bad". I've heard of
accuracy levels as high as 90% and I don't think that's too far
fetched. With HostIP reporting 50% on the user survey and them being
what I can demonstrate as "bad", 90% isn't a stretch at all.
Look at a geo use case. If there were a cyber threat level,
a defcon so to speak, and the highest level is 5 and we reach this
level someday, it could be prudent to build filter lists based on geo
located routing table data and begin to block and log certain sources
based on the threat level alone. Good geo data makes this entirely feasible.
Applying this type of thinking to Internet doomsday scenarios
will be key in survivability, IMHO. If you want every solution
to be 100%, we're likely to be down for some factor longer than
we need to be.
Anyhow, back to your regularly scheduled show. 
-M<
In article <c6f8c0e90605151039s1de02575u4520dc0e9867b41b@mail.gmail.com>, Ashe Canvar <acanvar@gmail.com> writes
Thanks for all your replies. I came across
http://www.hostip.info/use.html, which looks good, at least from a
API/ ease of use prespective.
I just tried that, says I'm 100 miles south of where I really am. That's quite a long way out in a small country like England.
This is a frequent source of silly news stories - viz. the recent one, based on Google Trends, that Birmingham (UK) is the "top city" for porn searches and Brentford (UK) in the top five despite being a small suburb of London. Reason: both are the location of big isp NOCs.
Since you completely ignored the security aspect, I'll address your
reference to Google Trends.
This is what you are probably talking about:
http://www.google.com/trends?q=porn
If what you are saying is true, that's some pretty bad
geo-location and YMMV, but what source are you using to
discount Googles numbers?
Are you saying that everyone on all 3 shifts in those "two large NOC's"
are searching for Porn on Google?
Or are you saying that all their
netblocks are in whois and have roles that state their blocks are located
at those NOC's?
If it's the latter, that would support either you being
innacurtae in your assumption about the Trend, or google being wrong. I'd
need more proof that Google is that far off and that it would "appear"
as though they are simply using whois registrations for geo locating
in their Trends product. I'd tend to doubt it. Anything is possible, I
suppose.
-M<
Hostip.info is so bad... One can find the exact location of my ip in the
ripe-database and the tool doesn't get it. It claimed that I'm in some sort
of 100souls small town altough I'm living in a major city. And hey: I was
using an ip out of a hoster's block - not a dialup or something like that.
Tssssss
The NSA was granted a patent for an IP geo-location technology based on triangulation using latency measures. We played around with a similar approach using UDP several years ago and you could triangulate to the zip code level or so. A better way I think than the current approaches being discussed. Not sure if the NSA patent is being commercialized or not though.
http://news.com.com/NSA+granted+Net+location-tracking+patent/2100-7348_3-5875953.html
Date: Mon, 15 May 2006 21:05:35 +0100
From: Roland Perry
I just tried that, says I'm 100 miles south of where I really am. That's
quite a long way out in a small country like England.
<me too>
Home cable returned "haven't got a clue".
I tried a couple other netblocks that returned different places in
Florida, Mississippi, and Illinois. Not too good when the correct
answers are Kansas and California.
</me too>
*yawn*
Eddy
Date: Mon, 15 May 2006 17:24:48 -0400
From: sgorman1@...
The NSA was granted a patent for an IP geo-location technology based
on triangulation using latency measures.
It could probably be foiled by this patented technology:
which is equally reliable and useful. 
ObOp: Latency and jitter cause problems with triangulation. I find
zipcode-level accuracy hard to believe for a predictive system.
Eddy