Why Real-Time Traffic Analysis Beats IP Databases — The Evidence
Academic research consistently shows that static IP geolocation databases are slow, stale, and blind to behavior. Here's what the studies actually found, and why observing the live connection is the only honest answer.
An IP database is a snapshot. It is a file on disk that maps an address to a location and an operator, frozen at the moment it was built. When you query it, you are not asking "who is this visitor?" — you are asking "what did this address look like last Tuesday when the database was refreshed?" The difference between those two questions is the difference between a static lookup product and real-time traffic analysis, and the research literature has been quantifying that gap for years.
This article pulls together what independent academic studies — not vendor whitepapers — have found about the limits of IP databases, and why observing the live connection is the only way to close those gaps.
The Snapshot Problem: Your Database Is Already Stale
The most fundamental problem with an IP database is that IP assignments move. A 2021 longitudinal study from Sorbonne Université and the Naval Postgraduate School (Gouel et al., "Longitudinal Study of an IP Geolocation Database," arXiv:2107.03988) analyzed ten years of snapshots from a popular geolocation database and found that 47% of end-user IP addresses moved by more than 40 km between successive database updates in 2019 alone. The study went further: when reproducing prior research that depended on geolocation lookups, the median distance from ground truth shifted from 167 km to 40 km simply by using a snapshot taken two months apart from the original.
In other words, the same database, the same query, the same IP — and the answer moved by more than a hundred kilometers depending on which build you happened to download. A database that refreshes daily still hands you yesterday's truth, and on mobile networks and VPNs, yesterday's truth may be a different city, a different operator, or a different country from today's reality.
Real-time analysis does not have this problem. It observes the connection that is happening right now — the TCP handshake, the TLS ClientHello, the browser probe, the QUIC upgrade — at the moment the visitor arrives. The signal is measured against the actual packet, not against a row in a file that may be weeks old.
The Granularity Illusion: Paid Is Not More Accurate
If staleness were the only problem, you might hope that buying the premium tier would buy you a better answer. The research says otherwise. Saxon and Feamster's 2021 study ("GPS-Based Geolocation of Consumer IP Addresses," arXiv:2105.13389) used smartphone GPS ground truth — arguably the most accurate location reference available — to evaluate commercial geolocation databases against reality. Their finding, in the authors' own words: "often the paid versions of these databases are not significantly more accurate than the free versions."
The same study found that databases are meaningfully more accurate on fixed-line networks than on mobile, and concluded that "relying on IP geolocation databases to understand Internet access in densely populated regions such as cities is premature." The premium tier does not give you a sharper picture of the visitor; it gives you more inferred fields derived from the same coarse prefix data. We covered the commercial mechanics of that in our earlier piece on city-level geolocation.
The Mobile Gap: Ten Times Worse Where It Matters Most
The 2026 study "Lost in the Prefix: Revisiting IP Geolocation Accuracy Across Networks and Geographies" (Nabi et al., arXiv:2605.21937) evaluated four major providers — MaxMind GeoLite2, IPinfo, IP2Location, and DB-IP — against ground truth from RIPE Atlas and UNICEF Giga across 175 countries. The headline numbers are stark:
- Mobile networks exhibit median errors 10× higher than fixed networks across all four providers — 179 to 207 km on mobile versus 3 to 16 km on fixed-line.
- Global South regions fail far more often: Asia shows 53–61% failure rates and Africa 66–72%, compared to 9–20% in Europe.
- Approximately 70% of mobile prefixes span more than 100 km geographically, meaning the database cannot resolve below that radius no matter how many fields it claims to offer.
The study traced both gaps to a single structural cause: prefix granularity. Where a provider's prefix is coarser than the BGP announcement it maps to, the error explodes — and that happens most on mobile networks and in the regions with the least infrastructure investment. A database cannot solve this by adding more columns; the underlying registration data is simply too coarse.
The Behavior Gap: What Databases Cannot See at All
Staleness and granularity are the problems databases might mitigate with faster refreshes and better data. The behavior gap is the one they cannot solve at all, because it is not a data problem — it is an observation problem.
An IP database tells you where an address was registered. It cannot tell you:
- whether the connection is coming through a VPN or proxy tunnel
- whether the User-Agent string matches the operating system the network stack actually reveals
- whether a real browser engine executed the JavaScript probe or whether a script is wearing a browser's clothes
- whether the TLS handshake looks like a genuine client or a fingerprinting library
- whether the visitor has been seen on a blacklist or matches a custom rule you defined
These are not location questions. They are behavior and identity questions, and they can only be answered by observing the live connection at the moment it happens. An IP database, by definition, has no access to the packet, the handshake, the probe execution, or the customer's policy. It can only tell you what the address block was last registered as.
The Cross-Provider Disagreement Problem
A 2023 IEEE study ("Accuracy and Coverage Analysis of IP Geolocation Databases," IEEE, 2023) compared MaxMind, DBIP, IP2Location, and IPGeolocationIO across the entire IPv4 space. Its conclusion: coverage was comprehensive, but "accuracy is far from satisfactory" and the information must be "used cautiously and verified before making any decisions based on it." The same study found significant disagreement between providers on the same IP addresses — meaning that which vendor you chose changed the answer you got, by tens or hundreds of kilometers, for the same visitor.
When the four major databases disagree on the same address, the only way to know which one is right is to observe the connection itself. That is what real-time analysis does: it replaces which vendor do I trust? with what does the actual packet tell me?
What Real-Time Analysis Actually Changes
The shift from database lookup to live analysis is not incremental. It changes the category of question you can answer:
| IP Database | Real-Time Analysis |
|---|---|
| Where was this address registered? | What is this connection doing right now? |
| Updated on a schedule | Observed at the moment of the request |
| Blind to VPN, proxy, and tunneling | Detects network-stack and protocol anomalies |
| Cannot see the browser | Proves real browser execution |
| Cannot apply customer rules | Applies your policy on every request |
| Disagrees across vendors | Single source of truth: the live packet |
| Sub-city claims that drift by tens of km | City-level honesty, behavior-level insight |
The research is consistent and it is not flattering to the database model: the data is stale, the premium tier does not help, mobile and Global South accuracy is an order of magnitude worse, the providers disagree with each other, and no database can see whether the visitor is a bot, a tunnel, or a spoofed environment. The only honest answer to "who is this visitor?" is to watch the visitor arrive — and decide before the door opens.
Sources
- Gouel, M., Vermeulen, K., Fourmaux, O., Friedman, T., & Beverly, R. (2021). Longitudinal Study of an IP Geolocation Database. arXiv:2107.03988.
- Saxon, J., & Feamster, N. (2021). GPS-Based Geolocation of Consumer IP Addresses. arXiv:2105.13389.
- Nabi, S. T., Bliton, J., Chung, T., & Hasan, S. (2026). Lost in the Prefix: Revisiting IP Geolocation Accuracy Across Networks and Geographies. arXiv:2605.21937.
- Accuracy and Coverage Analysis of IP Geolocation Databases. IEEE, 2023. (MaxMind, DBIP, IP2Location, IPGeolocationIO comparison.)
- Freund, M., et al. (2021). A deep dive into the accuracy of IP Geolocation Databases and its impact on online advertising. arXiv:2109.13665.