How IP Geolocation Databases Map Coordinates to Subnets
An engineering breakdown of how commercial geolocation providers convert 32-bit and 128-bit IP subnets into estimated latitude, longitude, and municipal boundaries.
Quick Answer
IP packets contain no geographic or GPS coordinates. Geolocation databases infer physical location by aggregating five primary signals: Regional Internet Registry (RIR) WHOIS records, RFC 8805 ISP self-published geofeeds, BGP Anycast routing data, multi-vantage latency triangulation, and mobile device Wi-Fi/GPS telemetry correlations.
- No GPS in IP: Geographic data is completely synthesized from external telemetry.
- RFC 8805 Geofeeds: The modern standard for network operators to advertise subnet locations.
- Resolution reality: Country resolution is >99% accurate; street-level resolution is a myth.
1. The Four Pillars of IP Geolocation Synthesis
Unlike mobile cellular positioning that relies on satellite trilateration or cell tower triangulation, IP geolocation is an aggregated probabilistic model. Providers combine multiple disparate telemetry streams:
2. Data Source Comparison and Failure Modes
Each geolocation intelligence source possesses unique strengths, update frequencies, and structural failure modes:
| Data Source | Update Cadence | Confidence Level | Typical Failure Mode | Primary Use |
|---|---|---|---|---|
| RFC 8805 Geofeed | Daily to Weekly | High (95%+) | Unmaintained ISP files with outdated subnets | Modern broadband and CDN routing |
| RIR WHOIS Records | Monthly to Quarterly | Medium-Low (Country only) | Shows ISP corporate headquarters instead of user city | Baseline legal ownership validation |
| BGP Anycast Probes | Real-time (Minutes) | High (Regional) | Anycast routes traffic to closest edge, masking origin | CDN edge detection & route sanity |
| Latency Triangulation | Continuous | Medium-High (100km radius) | VPN encryption, queuing delay, or path asymmetry | Sanity-checking impossible locations |
| Crowdsourced Telemetry | Continuous (App-driven) | High (Urban areas) | Stale mobile app Wi-Fi BSSID caches | Commercial consumer targeting |
Geolocation Resolution Pipeline Decision Tree
[ IP Prefix Geolocation Determination ]
|
+------------------------+------------------------+
| |
[ ISP Published Geofeed ] [ No RFC 8805 Geofeed ]
RFC 8805 / RFC 9092 CSV |
| +-----------------+-----------------+
High Confidence Match | |
City / Region / Country [ Active Probe Triangulation ] [ RIR Registry Data ]
| Fiber speed-of-light RTT limits ARIN / RIPE / APNIC
| Multi-vantage point ping anchors Often lists corporate HQ
| | |
+-------------------------------+-----------------------------------+
|
[ Final Geolocation Output ]
Country (~99%), City (70-85%)
Coordinates = City centroid center
3. The Coordinates Centroid Myth
Users often look up their IP address and find an exact latitude and longitude (such as 37.751, -122.42). Many believe this points directly to their house or apartment building.
This is an engineering illusion. Geolocation databases do not possess street-level accuracy. When an IP is resolved to a city (e.g., San Francisco, California), the database outputs the geographic centroid (the mathematical center) of that municipal polygon or postal code. The coordinates represent the center of the city, not a physical hardware device.
4. Practical Verification: Inspecting Geolocation via CLI
Query your current network location and inspect traceroute hop latencies:
Frequently Asked Questions
Does an IP packet contain GPS coordinates or physical location data?
No. The IP protocol header (RFC 791 for IPv4 and RFC 8200 for IPv6) contains only source and destination IP addresses, hop limits, and routing headers. IP packets contain zero location or geographic metadata. Geolocation is entirely external inference produced by commercial vendors matching IP prefixes against third-party registries and telemetry.
What is an RFC 8805 IP Geofeed?
RFC 8805 defines a standardized CSV format allowing network operators and ISPs to publish their own authoritative IP-to-location mapping files (Geofeeds). Geolocation database providers automatically scrape these feeds to update city, region, and postal code records whenever an ISP reallocates subnets.
How does latency triangulation (multilateration) estimate IP location?
Because light travels through single-mode fiber optic glass at roughly 200 kilometers per millisecond (two-thirds the speed of light in a vacuum), ping round-trip times establish an absolute physical boundary. If an IP responds to a London probe in 2 ms, that host cannot physically be located in Tokyo or New York.
Why do different lookup tools report different cities for the exact same IP?
Each geolocation vendor (MaxMind, IPinfo, DB-IP, BigDataCloud) maintains proprietary collection algorithms, update cadences, and data sources. If an ISP transfers a /22 subnet from Chicago to Dallas, one vendor might update their database weekly, while another refreshes monthly or relies on stale WHOIS records.
Data & Technical Sources
- IETF RFC 8805 — A Format for Self-Published IP Geolocation Feeds
- IETF RFC 9092 — Finding and Using Geofeed Data in the RIR System
- IETF RFC 791 — Internet Protocol Specification (No geographic fields)