How does geographic lookup by IP work?

Question

Is which IPs are assigned to which ISPs public information? How do geo IP services obtain this information and maintain this information?

How can I personally figure out where a certain IP belongs without using one of these services?

Starlet

You might be interested in the xkcd IP map. – Turbine

Answer 1

For what it's worth, I worked at a senior level in the ISP industry for more than a decade so I have quite some experience with this.

Large IP ranges are allocated as needed by IANA to each of the Regional Internet Registries.

The regions are generally continental in size - IP addresses are not assigned on a per-country basis.

The RIRs in turn then allocate IP addresses to ISPs, who in turn assign them to end-users.

Each of the RIRs maintain a whois server which can be queried to find out not only which ISP has been assigned any netblock, but to a certain extent which end-user, and that end-user's address.

Note that many ISPs do not fill out this information for every single customer. Hence if you're a residential subscriber of a DSL service, it's likely that the Geo records will give the address of your ISP, and not your own address.

The various GeoLocation providers mostly work by mining these whois records. Note that the legality of doing so is something of a gray area - RIPE's database copyright statement is here.

IANA also maintains the root zone for the DNS, but that is completely separate from any IP allocation functions. It is very important to maintain the distinction between domain name operations and IP addresses.

Vaientina

Answer 2

There are a variety of libraries that have mapping tables as well as services you can incorporate into your code.

The most important thing to understand is that there is no direct relationship between an IP address and any part of the world. The addresses are allocated in large blocks to organizations that are roughly geographical, which in turn allocate smaller blocks, this may happen at several levels for any given IP address (Alnitak explains the process well).

The fact is: WHOIS data does not have to be accurate. If I have an address block, I can say it is on Mars. And even if you narrow down the location of the final organization (say a very small ISP in Alaska), the user might be using dialup from Hawaii, or the server might be hosting a company from Guam.

So, there is always an element of risk/estimation in mapping an IP address (or a domain name) to a physical location. This is not to say you should never do it, there are many applications where rough or imperfect information is very useful.

Magniloquent

Answer 3

To answer the specific question about "how it works": there's alot of manual labor involved, and the databases are to a large extent maintained manually. Just as other answers point out, there's no real correlation between IP ranges and countries, much less specific regions. Recently the system of IP address space distribution has been even more decentralized which means small private vendors can acquire IPv4 address ranges regardless of geographic region. This is why Google acquried Urchin so they could use their services for Google Analytics, which provides very accurate IP-to-geographic-region information.

If you don't want to use a service like MaxMind (free for personal use, and the database is open to some extent) or Google Analytics (free for personal use), there's free (and hence always slightly outdated) databases floating around, sometimes as flat files.

Quack

Answer 4

Beware, the data is often slow to be updated, and even slower to replicate. My work place changed ISPs a number of years ago, and we were assigned a block of formerly Canadian IP addresses (we're based in the US), for months Google continued to give us google.ca as our default search engine. About 1/2 the time my home IP address comes up as being from my town, the other 1/2 from a town in another state.

Jason is right that the process is the same, but the updates are even slower and the data less accurate.

Openeyed

Well yes, as you move down the domain stack things get slower and slower and take longer to propagate out... – Commanding

There are also problems if you ISP is headquatered in another country. Joel wrote about this with his host being Canadian. – Motteo

Jason - that's rubbish. It's not "how far down the stack" you are. Any ISP can make a change that's visible in the "whois" data instantly. What's slow is the (probably illegal) crawling of that data by the GeoLoc providers. – Vaientina

It violates the terms of use. So, "illegal" if you will. – Quack

It's a civil breach of the database copyright. In my jurisdiction that's illegal. – Vaientina

Answer 5

Alnitak's answer is pretty much on the mark.

As a side note, if you want to use a .dll to determine the user's location, then you can try this IPAddressExtension found on CodePlex. It has an internal database of ISP's to locations. As mentioned above by Alnitak, each ISP have IP blocks .. so this information is all buried inside the .dll :)

It's really easy to use. Just reference the .dll and then create an instance of a System.Net.IpAddress object! the extensions are listed on it.

I also need to declare that i'm the author of that codeplex project/product.

Please check it out :)

EDIT: added information about me being the author of that product.

Arne

You should edit your answer to indicate that you yourself are in fact the author of IPAddressExtension. Otherwise, people may think you are abusing the SO terms of use. – Quack