Use GeoIP with Artica PCAP Filter

• Back to Artica PCAP Filter command-line main section

GeoIP databases can be used to perform two operations. 
Add to events the country of origin of an IP address and/or block an IP address if it comes from certain countries. 
Available from version 1.0.29

Enable/Disable feature

Use the -geoip-on token to enable the location verification

Use the -geoip-off token to disable the location verification

Set the GeoIP database path

If you are using your own GeoIP database updater and do not use the /usr/local/share/GeoIP directory, set the database directory using the -geoip-db token

articapsniffer -geoip-db /usr/local/share/GeoIP

Set the GeoIP License and Account ID

You can obtain a free MaxMind Account and license using this procedure

Use the  -geoip-account to set the Account ID

Use the  -geoip-key to set the license key 

articapsniffer -geoip-key Asdfgt6

Set the GeoIP update schedule 

Use the -geoip-schedule to define the hourly period (default 2)

articapsniffer -geoip-schedule 2

Download database 

If running in daemon mode, sources are checked every 2 hours

Without daemon mode, use the -geoip-update token to launch downloads.

Set the denied countries 

To deny IP address from countries, set the ISO codes separated by a comma with the token -geoip-deny

articapsniffer -geoip-deny CN,SG,US

Set the allowed countries

To allow IP addresses from countries, set the ISO codes separated by a comma with the token -geoip-allow

Useful examples:

articapsniffer -geoip-deny all

articapsniffer -geoip-allow FR,DE,US

This will deny all countries except IP addresses from FR, DE or US.

articapsniffer -geoip-deny FR,DE,US

articapsniffer -geoip-allow all

This will deny only IP addresses from FR, DE or US.

articapsniffer -geoip-deny none

articapsniffer -geoip-allow all

This will do nothing; it just logs country information.

articapsniffer -geoip-deny none

articapsniffer -geoip-allow FR,DE,US

This will do nothing: deny is none, so allow has no effect; it just logs country information.

articapsniffer -geoip-deny all

articapsniffer -geoip-allow all

This will do nothing: deny is all but allow is also all; it just logs country information.

Test an IP address

The token -geoip-test [Ip address] allows you to check an IP address.

It answers with the country code and the country name.