Home / server / Questions / 210975
Accepted
John Berryman
Asked: 2010-12-10 10:44:28 +0800 CST

Understand IP addresses and location

  • 772

I risk posing an ill formed question here, but I'll give it a whirl.

Does it generally stand to reason that the nearer IP address A is to IP address B numerically, then the nearer IP address A is to IP address B geographically?

Whatever your feelings, it would be most helpful if you could point me toward some good reading material on this.

networking ip-address network-protocols geolocation

5 Answers

  1. Does it generally stand to reason that the nearer IP address A is to IP address B numerically, then the nearer IP address A is to IP address B geographically?

    Most definitely not.

    IP Netblocks are handed out by IANA to the Regional Internet Registries (RIRs), who in turn hand out netblocks to individual organizations in their region. Once handed out, each recipient org can do whatever they want with those address. So, while a netblock may be initially handed out in the APNIC region, there's nothing preventing a company from using those IP addresses say, in Europe or the United States.

    Additionally, some addresses in a netblock may be used in one corner of the globe, while others in a completely opposite corner.

    See, for instance, IANA's IPv4 Address Space Registry page. 40/8 is allocated to the Eli Lily company, 41/8 is allocated to AfriNIC, and 42/8 is allocated to APNIC. Those three sequential netblocks are allocated to three geographically disparate bodies.

    • 13
  2. Best Answer

    A.B.C.001 and A.B.C.002 are very likely to be in close physical proximity, possibly as likely as 99% that they are on the same city block.

    A.B.C.001 and A.B.C.254 are only slightly less likely to be so.

    A.B.001.D and A.B.002.D are less likely still, perhaps 90%, for a 256x as large definition of "close".

    A.B.001.D and A.B.254.D slightly less likey again.

    This pattern continues. You could calculate relatively accurate percentages for the top two octets by simply polling a reliable geolocation service.

    In the olden days (2006) when IPv4 still had plenty of available address space, xkcd made a Map of the Internet that shows distribution of the first octet by country and organization. It's gotten a lot denser since then, but the general pattern continues, with neighboring first octets having about a 30% chance of being in the same country or region.

    • 5

  3. You know, not only does numeric "closeness" not have any direct relation on geographical closeness, with the widespread use of NAT there's not even any guarantee that requests from the SAME IP have any geographic relation to each other, in terms of the geographic location of the end user or machine making the request. There are plenty of corporate networks that are spread across the US that have only a single internet drain, for instance...

    UPDATED: I thought of another couple examples using some parts of network design (meaning, not directly related to an IP assigned to Joe Blow's home connection).

    First, it's common for a network designer to have a larger subnet (like, say, a /24) set aside solely to be used for point to point connections (that is, carved into a bunch of /30s). So, 1.1.1.1 might be in Chicago, 1.1.1.2 might be the other end of the link in Los Angeles, etc. Not only are adjacent IPs in often in different physical locations by design, the entire supernet might be filled with these /30s that are all in different locations.

    Another similar example is loopback IPs. Again you might have a /24, but instead of being carved up into /30s it's carved into /32s (single IPs), each of which is used on a loopback interface on a router. So, similar to above, 1.1.2.1 might be lo0 on a router in Chicago and 1.1.2.2 might be lo0 on a router in Los Angeles, and the two routers don't even have to have a direct connection between them any more.

    • 3

  4. ISPs will buy range of IP addresses and sites that trace IP addresses like http://www.ip-adress.com/ip_tracer/ Keep track of which ISPs have which addresses where.

    So... if IP address A & B are numerically close as in under the same netblock then they are probably geographically close but there is no guarantee that the ISP will use all of their IP addresses in the same region. The netblocks are distributed throughout the world and were sold first come first served so in general if they are not in the same netblock then the are geographically unrelated even if they netblocks are close numberically IE: the 93.0.0.0 isn't close to 95.0.0.0 but the ISP distributing 95.10.10.1 is probably distributing 95.10.10.2 in the same region.

    • 2

  5. However, if you do a whois or reverse DNS lookup on two addresses, and they are in the same netblock, or originate from the same ISP, you can draw some conclusions from that, I believe.

    Most residential ISPs reveal a lot about location in their reverse DNS lookups.

    • 1