Geofeed: IP address geolocation

Updating the geolocation of IP networks and ranges with Geofeed.

How often does it happen that you visit a website and it turns you away, claiming you are in another country? It is unpleasant for the user and for the internet provider too — the provider has to dig through its IP address database and find where the outdated geolocation is recorded.

The situation. Take a video platform, “X”, that is attacked by hackers on a regular basis. The reasons for the DDoS attacks are unknown, but the geolocation is obvious — foreign regions.

The owner of the site gets tired of the DDoS attacks. Instead of blocking IP addresses one by one, they close platform “X” to every user with a foreign prefix. The DDoS attacks die down, but something seems to have broken.

What the customer sees. Customers can’t watch a series on “X”: the site says it is closed to foreign visitors. But the customers are not foreign.

Complaints come in about “X” and about the internet provider. The provider decides to find out why the video platform thinks its customers’ IP addresses are foreign.

The conversation between the provider and “X”. The internet provider contacted a representative of “X” and found out where they get their information about user locations. To determine geolocation, the video platform uses the GeoIP provider MaxMind — an aggregator that stores information about IP addresses.

What does the GeoIP provider have to do with it?

An internet provider needs a lot of IP addresses to operate. Given how scarce they are, finding them is not easy. Sometimes addresses have to be bought from foreign internet providers.

Sometimes, when an IP address moves, say from Turkey to the UK, the aggregators don’t update the information in their registers. That is the answer to the problem the customers of “X” had: the GeoIP provider MaxMind forgot to update the geolocation of the IP addresses.

The popular GeoIP providers include MaxMind, DB-IP, ipinfo, IPdata.co, IP2Location, IPhub, IPIP, IPligence and NetAcuity.

There are several ways to update the geolocation of IP addresses.

The old-fashioned way to update geolocation

Usually, internet providers collect the outdated addresses, contact the aggregator and fill in special forms.

The drawbacks of this approach:

— it takes a lot of time: you have to fill in a large number of different forms; — if the outdated IPs are listed with several aggregators, you have to contact each of them.

But there is a simpler way.

Geofeed: making geolocation updates simpler

In 2013 Google introduced a standard for exchanging the geography of IP addresses — Geofeed. Since 2020 it has been part of the official RFC documents.

How the data is presented

Geofeed defines a single data format for exchanging the geolocation of addresses. The provider has to build a table with the following fields:

IP prefix/subnet (in IPv4 or IPv6 format), country code, region, city

RFC 8805, for example:

95.85.83.0/24,GB,GB-LND,London

2001:db8::/32,GB,GB-MAN,Manchester

The correct spelling of countries and regions is given in the ISO 3166 standard — see the link here.

The finished CSV file can be exported automatically from a database and then saved on a server so that it can be reached over HTTPS.

Publishing the prefixes

Once the table is saved, the provider needs to add a link to it in its regional internet registry (RIR) — AFRINIC, APNIC, ARIN, RIPE NCC or LACNIC.

The built-in Geofeed attribute

In RIPE you can add a field (attribute) of type Geofeed directly to inetnum and NetRange objects. Then you put the link to the data table in that field.

You can see what Google’s Geofeed table looks like at this link.

Getting in touch with GeoIP providers

Once the Geofeed has been added to the regional registry’s database, you can contact the aggregator and give them the link so that they update their geolocation information. The aggregator will then periodically collect the new data about the provider’s addresses from that link and bring its register up to date.