NAME
rwgeoip2ccmap - Create a country code prefix map from a GeoIP data file
SYNOPSIS
unzip -p GeoIPCountryCSV.zip | \
rwgeoip2ccmap --csv-input > country_codes.pmap
gzip -d -c GeoIP.dat.gz | \
rwgeoip2ccmap --encoded-input > country_codes.pmap
DESCRIPTION
Prefix maps provide a way to map field values to string labels based on a user-defined map file. The country code prefix map, typically named country_codes.pmap, is a special prefix map that maps an IP address to a two-letter country code. It uses the country codes defined by the Internet Assigned Numbers Authority (http://www.iana.org/root-whois/index.html).
The country code prefix map is used by the ccfilter(3) plug-in to partition by, count by, sort by, and display the country code in SiLK Flow files. The rwip2cc(1) command can use the map file to display the country code for textual IP addresses.
The country code prefix map is based on the GeoIP Country(R) or free
GeoLite database created by MaxMind(R) and available from
http://www.maxmind.com/. The GeoLite database is a free evaluation
copy that is 98% accurate which is updated monthly. MaxMind sells
the GeoIP Country database which has over 99% accuracy and is
updated weekly.
The database comes in two forms:
- GeoIPCountryCSV.zip
-
as a compressed (zip) textual file containing the IP range, country name, and county code in a comma separated value (CSV) form
- GeoIP.dat.gz
-
as a compressed (gzip) binary file containing an encoded form of the IP address range and country code
OPTIONS
Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.
One of the following switches is required:
- --csv-input
-
Treat the standard input as a textual stream containing the CSV (comma separated value) GeoIP country code data.
- --encoded-input
-
Treat the standard input as a binary stream the encoded GeoIP country code data.
EXAMPLES
Obtain your copy of the MaxMind GeoIP Country database, either the comma separated value version or the binary version (GeoIP.dat.gz). To create the country_codes.pmap data file, run
-
For the CSV version:
$ unzip -p GeoIPCountryCSV.zip | \ rwgeoip2ccmap --csv-input > country_codes.pmap -
For the binary data format:
$ gzip -d -c GeoIP.dat.gz | \ rwgeoip2ccmap --encoded-input > country_codes.pmap
Once you have created the country_codes.pmap file, you will need to copy it to $SILK_PATH/share/silk/country_codes.pmap so that the ccfilter plug-in will use it.