<cough> scam_snake_oil_etc </cough> On Mon, 15 May 2006, Alain Hebert wrote: : :GeoIP - http://www.maxmind.com/geoip/ : :Ashe Canvar wrote: : :> :> Hi all, :> :> Can any of you please recommend some IP-to-geo mapping database / web :> service ? :> :> I would like to get resolution down to city if possible. :> :> Thanks and Regards,

I'm not quite comfortable with the idea of building a market audience based on data with at best dubious accuracy. On Mon, 15 May 2006, Martin Hannigan wrote: :At 12:49 PM 5/15/2006, Brian Wallingford wrote: : :><cough> scam_snake_oil_etc </cough> : : :How so?

Thanks for all your replies. I came across http://www.hostip.info/use.html, which looks good, at least from a API/ ease of use prespective. So how would the illustrious people on nanog solve the folowing issue: + PHB walks into my office and asks for a global distribution of my 500K customers. + Preferably wants a gigantic world map with realtime visualization of where the currently active customers are I can solve the visualization part and the GIS issues. But comes down to the accuracy of the geo-ip database in the end. -ashe On 5/15/06, Bill Nash <billn@odyssey.billn.net> wrote:

It works for spammers.

- billn

On Mon, 15 May 2006, Brian Wallingford wrote:

...

I'm not quite comfortable with the idea of building a market audience based on data with at best dubious accuracy.

On Mon, 15 May 2006, Martin Hannigan wrote:

:At 12:49 PM 5/15/2006, Brian Wallingford wrote: : :><cough> scam_snake_oil_etc </cough> : : :How so?

Hostip.info is so bad... One can find the exact location of my ip in the ripe-database and the tool doesn't get it. It claimed that I'm in some sort of 100souls small town altough I'm living in a major city. And hey: I was using an ip out of a hoster's block - not a dialup or something like that. Tssssss

-----Ursprüngliche Nachricht----- Von: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] Im Auftrag von Roland Perry Gesendet: Montag, 15. Mai 2006 22:06 An: nanog@merit.edu Betreff: Re: Geo location to IP mapping

In article <c6f8c0e90605151039s1de02575u4520dc0e9867b41b@mail.gmail.com>, Ashe Canvar <acanvar@gmail.com> writes

...

Thanks for all your replies. I came across http://www.hostip.info/use.html, which looks good, at least from a API/ ease of use prespective.

I just tried that, says I'm 100 miles south of where I really am. That's quite a long way out in a small country like England. -- Roland Perry

On Mon, 15 May 2006, Roland Perry wrote: > > http://www.hostip.info/use.html, which looks good, at least from a > > API/ ease of use prespective. > > I just tried that, says I'm 100 miles south of where I really am. That's > quite a long way out in a small country like England. 1.3ms is longer in small countries like England? -Bill

In article <Pine.SOC.4.61.0605152255040.4154@paixhost.pch.net>, Bill Woodcock <woody@pch.net> writes

...

I just tried that, says I'm 100 miles south of where I really am. That's quite a long way out in a small country like England.

1.3ms is longer in small countries like England?

I'm virtually certain it's not being done by propagation delay. What they've apparently done is look up the RIPE database, and found that my ISP has registered an address, with postcode, for the hostmaster function. They've reported the major town associated with the two most significant (out of six) characters of that postcode (Hemel Hempstead), although the address is actually in a smaller town twenty miles to the west (Stoke Mandeville). To complicate the issue, the ISP is formed by the acquisition of several smaller ISPs, and it seems unlikely (from my knowledge of the local topology) that the physical NOC is at the hostmaster's address. Finally, the "tail" from the NOC to my house (which appears as one hop) is over a connection into British Telecom's ADSL backbone, and then over the BT internal network which supports their wholesale ADSL product, as far as my local telephone exchange (which I can see out of my office window) and a short length of local copper. There's nothing in either the RIPE database, or timing of packets, which could say where in the country that tail is delivered. The ISP has my billing address, of course. -- Roland Perry

I just tried that, says I'm 100 miles south of where I really am. That's

quite a long way out in a small country like England.

I live in London and use BT Broadband. But geolocation shows me being in Ipswich up in East Anglia, a long way from London. I assume this is because the geolocation only knows that I use an IP address from a DHCP pool managed in Ipswich. They don't know anything about BT's own extensive network, and in the case of DSL using tunnels and DHCP servers, the real topology becomes entirely invisible. The end result is that most of England's population lives in Ipswich. Eat your heart out Alan Partridge. A few years ago, while working at a different company in London, I had a New York IP address because our company's internal network Internet gateway was in New York. Then they changed things around so that we used a gateway in London for all the European offices. But that meant that colleagues in France, Germany, etc... would all show up as being located in London. Nowadays, I use a VPN to work from home. The VPN software knows of multiple tunnel endpoint servers so if there is a problem with the UK server it fails over to a server in the USA. My IP address on the Internet comes from the NAT server at the Internet gateway. Depending on where the tunnel endpoint is, it could be a US address or a UK address. 100% accurate geolocation is not achievable but if you understand the issues then you can better make a decision how to apply geolocation services to your own problem. It may work well enough for some things. --Michael Dillon

In article <c6f8c0e90605151039s1de02575u4520dc0e9867b41b@mail.gmail.com>, Ashe Canvar <acanvar@gmail.com> writes

...

Thanks for all your replies. I came across http://www.hostip.info/use.html, which looks good, at least from a API/ ease of use prespective.

I just tried that, says I'm 100 miles south of where I really am. That's quite a long way out in a small country like England.

Only 100 miles? I entered the address of a box I have in Virginia, and it says it's in California. Well at least it got the country right.

Well, I'm sure that everybodies here understand that the city databases cannot be accurate more than 50%. The way we disperse static IP on commercial accounts there is not way they can figure out where the destination is. The last best guest will be the peer router before my routers. For me the country db is good enought for basic webalizer report for the customers websites. (This way my customers dont waste queries to countries.nerd.dk on non-spam related things) Have fun... Bill Nash wrote:

It works for spammers.

- billn

On Mon, 15 May 2006, Brian Wallingford wrote:

...

I'm not quite comfortable with the idea of building a market audience based on data with at best dubious accuracy.

On Mon, 15 May 2006, Martin Hannigan wrote:

:At 12:49 PM 5/15/2006, Brian Wallingford wrote: : :><cough> scam_snake_oil_etc </cough> : : :How so?

-- Alain Hebert ahebert@pubnix.net PubNIX Inc. P.O. Box 175 Beaconsfield, Quebec H9W 5T7 tel 514-990-5911 http://www.pubnix.net fax 514-990-9443

At 01:56 PM 5/15/2006, Valdis.Kletnieks@vt.edu wrote:

On Mon, 15 May 2006 13:14:41 EDT, Bill Nash said:

...

It works for spammers.

Certainly explains all the Turkish spam I get, what with me being just outside Ankara and all.

That's likely because they are attempting to do some sort of location analysis themselves and have limited data to work with. Spammers are generally not stupid. They are cheap since their ability o generate revenue is randomized based on the exploit of the day, so to speak. Targeting you with Turkish ads is probably a combination of being cheap and someone possibly stupid. Anyhow...before this thread turns into the debacle of incorrect information that the NTP one did -- Typically, an ip address is analyzed by using multiple sources of data. An attempt is made at a "triangulation" of sorts with both good and bad bits compared. As the good bits build the confidence factor in the triangulation rises. So you could have 2 pieces of info that do correlate, bring in the whois record, no correlation with that, and then toss it and bring something else in. Whois accuracy is not a factor here. Geo location isn't perfect, but it's not "bad". I've heard of accuracy levels as high as 90% and I don't think that's too far fetched. With HostIP reporting 50% on the user survey and them being what I can demonstrate as "bad", 90% isn't a stretch at all. Look at a geo use case. If there were a cyber threat level, a defcon so to speak, and the highest level is 5 and we reach this level someday, it could be prudent to build filter lists based on geo located routing table data and begin to block and log certain sources based on the threat level alone. Good geo data makes this entirely feasible. Applying this type of thinking to Internet doomsday scenarios will be key in survivability, IMHO. If you want every solution to be 100%, we're likely to be down for some factor longer than we need to be. Anyhow, back to your regularly scheduled show. :-) -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan@renesys.com

As a major caveat, all geolocation services do have some degree of inaccuracy, because the sources of data are very diverse. (Some ISPs provide complete subnet maps to MaxMind and other providers, whereas some data is scraped from WHOIS or provided by inference from end-users.)

And some organizations run their own internal networks across international borders. In other words, knowing that subnet X is allocated to company Y who has a 300 meg Internet connection in city Z, does not mean that all the users of that connection are also in city Z. They could be scattered around the world. This is why some companies use other sources of data to infer the location, i.e. if users of an IP address prefer yahoo.fr to yahoo.com, then that is one datapoint in favour of them being located in France. If you understand the principles of RBL weighting then you will get the idea. --Michael Dillon