MaxMind IP lookup defaults on a single location in Kansas


#1

Snowplow users that use the MaxMind database to look up the location of IP addresses (one of the configurable enrichments) might have noticed that a lot of traffic appears to come from one location in Kansas. This is no coincidence: http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm

From the article:

As a result, for the last 14 years, every time MaxMind’s database has been queried about the location of an IP address in the United States it can’t identify, it has spit out the default location of a spot two hours away from the geographic center of the country. There are now over 600 million IP addresses associated with that default coordinate.

MaxMind is working on a fix, but it’s worth keeping this in mind when consuming the data. One solution would be to exclude this specific location, and replace it with unknown.


#2

This happens surprisingly often unfortunately. For example in Australia unknown IP addresses resolve to -27,133 which is just off the Stuart Highway for ~20k IP blocks (not IP addresses, assignment blocks of IPs).

If you’re using the paid Maxmind database things are slightly better, though not by a lot, and unfortunately it’s inconsistent as to whether they use the centroid of a country or not if an IP is unknown. You can check the accuracy of the various databases for various countries here.

Some of the Maxmind libraries provide the accuracy radius field which can give you can idea of how close (very approximate) the IP is to the geographical location. It may be worth considering adding an extra field to the schema for geoip_accuracy_radius. Here’s what the current distribution looks like using the IPv4 GeoIP2 city database (free).

Accuracy (km) Count of IP blocks (ranges)
1.0 565179
5.0 330643
10.0 276903
20.0 376838
50.0 546108
100.0 305978
200.0 365533
500.0 334828
1000.0 767049

For reference this is near -27, 133.


#3

14 years??? How is it possible no one ever realized that?


#4

@christoph-buente one wonders :slight_smile:

Thanks for sharing all that @mike. I hadn’t come across that link before. I created an issue on GitHub to add the accuracy radius to our geo IP enrichment: https://github.com/snowplow/snowplow/issues/2788