How to check traffic by IP and by provider
Contents
Share
Checking traffic by IP means reading the address the way Metrica publishes it, and not turning on a counter filter in order to “have a look”. In the visit dimension the last byte of an IPv4 address is already zeroed. A filter that keeps a single address throws everyone else out of collection from then on, and that cannot be undone.
The names of robots are not looked up by address. The order of the Robots report is in how to find bots in Metrica.
The address in the dimension is already missing its last byte
In the dimension catalog the field ym:s:ipAddress is described as the visitor’s IPv4 or IPv6 address with the last byte of IPv4 and the last eight bytes of IPv6 set to zero. The catalog’s example is 77.88.21.0 and 2001:db8:85a3::. A zero at the end is not a separate computer and not an “empty address”. That is how the catalog shows the mask.
Comparing two rows that both end in .0 means comparing slices of a network, not two visitors. The catalog does not say that the same truncated address is one person or one program. How a program differs from a person is in bot or human. An address does not replace that difference.
The description does not name a connectivity provider. The word “provider” in the same catalog appears as a QR-code provider. A report that names the operator from the address was not on the pages that were checked. Until it exists, the operator is not read out of 77.88.21.0.
A fuller address is a different export, and it is not for today
The Logs API fields include ym:s:ipAddress labeled “IP address”. That page does not say the address is truncated the way the dimension is. The export and the dimension cannot be treated as the same number: the labels differ.
The Logs API introduction describes an export of raw visits. A token is required. Data for the current day is unavailable, because the day may be incomplete. On average 99% of visits finish within three days of starting, and a visit is still updated as new information arrives. A counter has a 10 GB quota for prepared logs, including files that have not yet been deleted from storage. That is a limit of the export, not the size of “bad” traffic. Thirty filters on a counter are a limit on the number of conditions, not a list of addresses you are supposed to fill.
The robotness field next to it in the catalog is a different field. The share of visits Metrica classed as robots is covered in robotness in Metrica. An address is not converted into that share.
A counter filter looks forward and does not let go
Counter filters can take a condition on IP. The guide’s example: keep only the traffic, field “IP address”, condition “equals”, value 192.168.0.2. For an interval the same page gives 192.168.0.0/24, 192.168.* and the range 192.168.0.0–192.168.255.255. Those are examples of how to write a condition, not a list of addresses to hunt in your own account.
The filter does not change data collected before it was turned on. What is collected after is changed irreversibly. A counter can have up to 30 filters. Turning on “keep only” one address in order to see who came means you stop recording everyone else from that minute. For checking the past, it is not a tool. For checking the future, it is already a selection you cannot roll back.
Two examples from the guides are easy to fold into one. 77.88.21.0 is the example of the truncated dimension. 192.168.0.2 is the example of a value you type into a filter yourself. The interval 192.168.0.0/24 keeps not one address but the whole written range. Until those three notes are kept apart, “check by IP” means three different actions.
Banning an ad impression by address in Direct is a different account and a different step. It is not here.
What an address does not prove
A click that stayed in spend and a click Direct has already removed are not distinguished by an address. The spend line is in what ad click fraud is. A Yandex Advertising Network placement is a different row too: the placement name and the visit address do not sit in one report. How to open placements is in suspicious placements.
A kind of program is not assigned from an address. Which purposes the guides actually name as kinds is collected in kinds of bots.
A check of the visit on the site looks at the network and the IP among other observations: behavior, the browser environment, request frequency and the ad-click parameters. One address does not become the decision. The outcome is to let the visit through, to give the browser a short task, or to keep it out. If the check does not answer, the visit is let through. Binetro does not print the truncated address from the dimension and does not turn on a counter filter.
The order, once an address is already in front of you:
If the row ends in
.0, as in the example77.88.21.0, that is the mask of the last byte, not a computer.Do not turn on a “keep only” filter for that address. It will not show the past, and it will narrow the future with no undo.
A raw address, if you need one, is looked for in a Logs API export, not in today’s day and not instead of the Robots report.
An operator’s name is not taken from these pages. Until there is a provider report, it is not invented.
Direct spend is not calculated from an address.