RE: Geofeeds are adversarial — was Re: Geofeeds are good

[Abdullah DevRel of IPinfo via NANOG <nanog () lists nanog org>]

Hi Tony,

> I compared IPinfo's answers to MaxMind's answers, for a random recent visitor from 44.198.66.156 to my website and 
> one notable difference is that you specify a larger CIDR block of 44.192.0.0/11 (2,097,152 addresses) whereas MaxMind 
> specifies a much smaller CIDR block 44.198.64.0/19 (8,192 addresses).

That is an AWS IP address, and it brings up an interesting point.

The /11 we display reflects the actual BGP announcement for that IP. You can verify this yourself on bgp.tools: 
https://bgp.tools/prefix-selector?ip=44.198.66.156

bgp.tools shows two overlapping prefixes for that IP:
- AS14618: 44.192.0.0/11 (High visibility)
- AS16509: 44.192.0.0/10 (High visibility)

There is no /19 announcement visible in the BGP routing table for that IP. The /19 that the other provider displays 
appears to be derived from a source other than BGP, possibly their own internal prefix segmentation or geofeed data.

We show the BGP-announced prefix because that reflects how the IP address is actually routed on the internet. The 
geolocation data (city, country) is determined separately from the CIDR displayed on the page, so the larger prefix 
does not mean less granular geolocation.

— Abdullah | DevRel, IPinfo
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/4RKVQ44QVZ3GCLE6ELHXIJTSK3Q7VHFQ/