IP Geofeeds: Trust, Accuracy, and Abuse

Описание: Abstract

IP geofeeds, standardized in RFC 8805, allow network operators to self-publish geolocation data for their IP prefixes. Adoption has grown steadily, from ~400 feeds in 2020 to over 3,300 in 2025. Major geolocation providers including MaxMind, IPinfo, and others now consume geofeed data. However, the self-published nature of geofeeds raises fundamental questions: How accurate are geofeeds? Which geofeeds can be trusted?

This presentation examines geofeed accuracy using two approaches: active RTT measurements from a global probe network (~1,100 probes across 143 countries), and ground-truth validation via GPS-equipped mobile devices. Our findings show country-level consistency of 92% for active measurements (96.6% IPv4, 79.6% IPv6) and 84.5% for mobile networks. City-level accuracy drops significantly: 79.6% for active measurements but only 29.9% for mobile networks, highlighting the gap between infrastructure location and actual user location. Top mismatches come from CDNs, tier-1 networks, VPNs, cellular providers, and IP leasing services.

We also address the emerging problem of adversarial geofeeds. Real-world examples include feeds mapping ~101k IPv6 prefixes to 249 countries and ~80k cities, as well as online guides instructing users how to craft metadata to manipulate geolocation databases. We discuss potential improvements to the geofeed ecosystem, including format updates (validity periods, standardized location identifiers), validation mechanisms, and hosting options to improve both accuracy and coverage while mitigating abuse.

Calvin Ardi:
Calvin Ardi is a research scientist at IPinfo. He has interests in Internet measurement, network security, and privacy.

https://nanog.org/events/nanog-96/con...