GeoIP

From NANOG

Why network operators need to know about GeoIP

As more and more websites display geographically-targeted content based on the IP address of the visitor, network operators assigned a netblock from their RIR can expect to receive complaints from users in that IP address space that they're receiving the wrong or bad content. The most common site that customers reference is Google. If an IP address is (incorrectly) associated with Canada, for example, the user will be re-directed to google.ca; with Germany, google.de. Other sites that use GeoIP are sporting leagues, web auctions, internet financial transaction brokers, etc.

How the data is populated

While it would seem that properly SWIPing a netblock should be enough to fix things, the reality is that websites who use GeoIP databases may use their own homegrown database or outsource it to any number of third-parties, everyone who has their own scheme in populating and maintaining data.

RIR entries don't necessarily reflect where the IP address space is used; some large companies have been assigned /8s and the supplied address is their headquarters, but their organization is spread around the globe.

Information can also be culled from transactional data. For example, Joe Smith in Des Moines, Iowa, buys a widget from Acme's online store. Acme may share or sell the IP address and town of the shipping/billing address to a third party, or, the third-party credit card processing service Acme uses captures the same information and shares or sells the same.

While few of us would place our trust in reverse DNS, it is a data point in identify an IP address's geographical location.

Some GeoIP information can be gleaned from BGP advertisements and the routers they are associated to, but things can get tricky here.

While most GeoIP vendors seek to identify an IP address down to a region, network operators are generally most keen that the proper country is represented, as the majority of content (and restriction to content, in the case of some types of intellectual property) are controlled on a national basis.

What do and how to check

If your netblock is not properly identified or you want to vet it in advance of deployment, at a minimum make sure it's properly SWIPed.

Here's a list of sites you'll want to check:

• Google does not have a form to verify an IP address, but it does have a specific form that you can fill out to correction request. Turn-around time is typically 1 to 3 weeks as updates are not made continuously.
• Akamai limits GeoIP verification by the public to one's own public IP, but if one can issue HTTP requests from an IP address in netblock in question (e.g. Cisco IOS supports "more http://www.akamai.com/html/technology/products/personalization.html"; use the "ip http client source-interface" command to specify the source interface) that should would work, too. Akamai does not have a page to verify the geographic location of an arbitrary IP address, but there are NANOG users with access to their company's Akamai management portal called EdgeControl where any IP address can be queried. There is no specific form to request a correction, but one can try Akamai's support page which can be found here.

• MaxMind's home page can be used to verify an IP address. Correction requests can be e-mailed to correction@maxmind.com.

There are some other GeoIP sites that appear to have a smaller presence online that may also deserve a check:

• GeoBytes' home page can be used to verify an IP address. Correction requests can be posted on their forum or on their original project page, Net World Map.
• hostip.info's home page can be used to verify an IP address. Correction requests can be submitted in bulk here.
• IP2location's home page can be used to verify an IP address. There is a form to submit generic feedback.
• IPGEO has several online checkers. There is a form to submit generic feedback.
• WIPmania has a free service. Click on "if false, correct it" to submit corrections.