Page 1 of 1

How does address lookup work for proxies/DHCP IPs?

PostPosted: Thu Mar 31, 2005 6:28 am
by jkronegg
Hello,

I would like to know how the IP lookup works if the IP address is from a proxy or if the IP address is dynamic (DHCP).

I've read that cities/country of /24 address are stored in a 256x256x256 cube. Obviously, if the IP address if dynamic or the host is a proxy, then this IP can have multiple location (for example if two people using the same proxy are registering the IP to hostip.info).

The question are:
1) does these multiple locations stored in the database ?
2) how the API deals with such multiple locations ?
3) are proxies automatically recognized and labelled as "proxy" (so that we know that the location is the physical location of the proxy, not the location of the people that use it) ?

Thanks,

Julien

Re: How dows address lookup work for proxies/DHCP IPs?

PostPosted: Thu Mar 31, 2005 1:08 pm
by bfolkens
jkronegg wrote:Hello,

I would like to know how the IP lookup works if the IP address is from a proxy or if the IP address is dynamic (DHCP).

I've read that cities/country of /24 address are stored in a 256x256x256 cube. Obviously, if the IP address if dynamic or the host is a proxy, then this IP can have multiple location (for example if two people using the same proxy are registering the IP to hostip.info).

The question are:
1) does these multiple locations stored in the database ?
2) how the API deals with such multiple locations ?
3) are proxies automatically recognized and labelled as "proxy" (so that we know that the location is the physical location of the proxy, not the location of the people that use it) ?

Thanks,

Julien


1) Each class C has a location - and most of the time a proxy (esp. smaller ISPs) will DHCP the last quadrant (which is the last x256 we don't keep track of since it's too discrete).
2) N/A - Each IP has a single location - we realized early on that a dynamic IP is an exception to this rule, so we keep track of the class C level at the highest resolution
3) No, they're not. Typically ISPs will upload their netblocks and so we will know the physical location for their servers (and thus, proxies).

Also keep in mind - that the updates are actually done at the class 'D' level - because we want to maintain control in circumstances like this anyway - where people make a bunch of updates at the raw IP level - we want to make sure they're not bogus, so we corroborate the results with the class 'C' above it.

I hope that explained it a bit better - lemme know if you have more questions...
[/list]