GeoIP databases can be used to perform two operations.
Add to events the country of origin of an IP address and/or block an IP address if it comes from certain countries.
Available from version 1.0.29
Use the -geoip-on token to enable the location verification
Use the -geoip-off token to disable the location verification
If you are using your own GeoIP database updater and do not use the /usr/local/share/GeoIP directory, set the database directory using the -geoip-db token
articapsniffer -geoip-db /usr/local/share/GeoIP
You can obtain a free MaxMind Account and license using this procedure
Use the -geoip-account to set the Account ID
Use the -geoip-key to set the license key
articapsniffer -geoip-key Asdfgt6
Use the -geoip-schedule to define the hourly period (default 2)
articapsniffer -geoip-schedule 2
If running in daemon mode, sources are checked every 2 hours
Without daemon mode, use the -geoip-update token to launch downloads.
To deny IP address from countries, set the ISO codes separated by a comma with the token -geoip-deny
articapsniffer -geoip-deny CN,SG,US
Set the allowed countries
To allow IP addresses from countries, set the ISO codes separated by a comma with the token -geoip-allow
Useful examples:
articapsniffer -geoip-deny all
articapsniffer -geoip-allow FR,DE,US
This will deny all countries except IP addresses from FR, DE or US.
articapsniffer -geoip-deny FR,DE,US
articapsniffer -geoip-allow all
This will deny only IP addresses from FR, DE or US.
articapsniffer -geoip-deny none
articapsniffer -geoip-allow all
This will do nothing; it just logs country information.
articapsniffer -geoip-deny none
articapsniffer -geoip-allow FR,DE,US
This will do nothing: deny is none, so allow has no effect; it just logs country information.
articapsniffer -geoip-deny all
articapsniffer -geoip-allow all
This will do nothing: deny is all but allow is also all; it just logs country information.
The token -geoip-test [Ip address] allows you to check an IP address.
It answers with the country code and the country name.