Re: Sources for IP geolocation data

[NetSecGuy <netsecguy () gmail com>]

To summarize with my comments on the different suggestions.

http://ip.ludost.net/  - This source just uses registry and bogon
info, I can generate that myself. I was looking for sources that
provide additional info.

The ntop module "p2c" does lookups via the net.  I'm dealing with a
lot of IP addresses so this method would take a long time.

http://www.maxmind.com/app/geoip_country  - This is exactly the kind
of thing I was looking for. Free version updated monthly. Excellent.

http://hostip.info/ - I am not sure about this one.  It seems to rely
on users to enter information and is only accurate down to the /24. 
The method used to store IP information is interesting.

http://www.networkthinktank.com/downloads.php - No info on sources,
but has an entry for every possible IP.

http://ip-to-country.webhosting.info/node/view/9 - Appears to use a
combination of RIR data  and user info.

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------