IP Location Tracking Inconsistencies/IPv6 AND Regular for same user?

Started by Mother_PopCorN, March 11, 2020, 10:56:59 AM

Previous topic - Next topic

Mother_PopCorN

Hello,

I appreciate bouncing this information off more knowledgable users! The motive of understanding the following information is to understand some of the inconsistencies between IP Tracking applications (G Analytics, and a few others) so I can more accurately dissect traffic flow to a website.

-My assumption for IP Location tracking is that it's not always accurate, especially if user is using a VPN or via the data on their mobile device (not wifi)?
-What are some other reasons that will affect accuracy? Attached you will see a few pictures of two users that viewed a website.
-I am however convinced they are the same user, as they both were identified as visiting within seconds of each other, as well as share the same device (Safari, Apple Phone)
-Google Analytics displays the location for one user as Raleigh, NC. For one Analytics App, while displays a IPv6, it hits Charlotte, NC. The second user via the same app, hits Irmo, SC. Another app shows the two users with "regular" IPs and not a IPv6.
-What explains there being two users in the first place (when it's the same person), and also having different IPs, and the variety of location inconsistencies?
-Generally, I also noticed that when tracking the location of the IP, let's say via IPlocation.net, there are three different results..
1) Geolocation data from IP2Location (Product: DB6, updated on 2020-3-1)
2) Geolocation data from ipinfo.io (Product: API, real-time)
3) Geolocation data from DB-IP (Product: Full, 2020-3-1)

Perhaps it's related to my initial questions, but is there a clear reason between the three (usually different) results?

Otanx

I don't see the photos you mentioned so I can't speak to those specifically. However, there are a few reasons why a single user will show up from multiple locations...

1. IPv4 vs IPv6. A user can have both addresses at the same time. How do they determine which to use? Typically this is the first address returned by DNS. There are implementations that try to prefer IPv6, but some don't. Also this could change every time they do a DNS lookup, or a cache expires.
2. QUIC and other load balancing protocols. I don't know the current status of QUIC, but Google was testing it to load balance web traffic over multiple connections. So if you had a cell phone with wifi and 4G both active it would use both connections to grab the data, and the user would show two different IP addresses. This is probably pretty rare right now, but who knows in the future.
3. Proxy and/or VPN. User goes to your website, and then realizes they need a file off their corporate file share. Connects to their company VPN, and then continues browsing your site. Now the session that established with out the VPN is continuing with the VPN.
4. Different geo-IP databases. There is a lot of voodoo that goes into the geolocation data bases, and they may all have different data for some addresses. As for why they have different data it boils down to how the associate a real location to an IP address.

There is nothing native about an IP address that ties it to a location so the geo IP guys have to figure it out, and then keep verifying it because it could move. Some of the ways they link locations are...

1. Registration information for the range. Look at ARIN, RIPE, etc. Whoever owns that IP has an address. Not very accurate, but it is better than nothing.
2. Owner of the IP tells them where it is used. If I am an ISP, and have IP Addresses in lots of cities I can work out an agreement with the location companies, and tell them where those IPs are used. This allows the geo-location company customers to better support my customers. Everyone is happy.
3. geo IP company buys location information from website owners. If I am a website owner, and I make users register for accounts that include their address as part of the registration. I can sell that information to geo IP companies. A user from IP A told me his address was in ZIP code 11111. Depending on the quality of your registration data that might be helpful in figuring out a geo location.
4. anycast service flow data. More technical, but if I deploy multiple servers on the internet with the same IP address then users will connect to the closest one. If I track what IPs connect to what server I can make the assumption that IP is close to the server.

Link all of that together, and the geo location companies guess where that IP is. Because different companies get different data, and weight that data differently the different databases will show different answers.

-Otanx

Mother_PopCorN

Otanx,

Thank you very much for answering my questions in perfect detail and breaking it down for me.

Not that it should alter the information you provided, but attached is the example I was referring to in my first post.

Otanx

So looking at your image I will throw another reason for what you are seeing... Cellular roaming. User moved from one tower to another, and from Verizon to Sprint.

-Otanx