NAME
rwgeoip2ccmap - Create a country code prefixmap from a GeoIP data file
SYNOPSIS
unzip -p GeoIPCountryCSV.zip | \
rwgeoip2ccmap --csv-input > country_codes.pmap
gzip -d -c GeoIP.dat.gz | \
rwgeoip2ccmap --encoded-input > country_codes.pmap
DESCRIPTION
Prefixmaps (pmaps) provide a way to map field values to string labels based on a user-defined map file. The country code prefixmap, typically named country_codes.pmap, is a special prefixmap that maps an IP address to a two-letter country code. It uses the country codes defined by the Internet Assigned Numbers Authority (http://www.iana.org/root-whois/index.html).
The country code prefixmap is used by the ccfilter(3) plug-in to partition by, count by, sort by, and display the country code in SiLK Flow files. The rwip2cc(1) command can use the map file to display the country code for textual IP addresses.
The country code prefixmap is based on the GeoIP Country® or free
GeoLite database created by MaxMind® and available from
http://www.maxmind.com/. The GeoLite database is a free evaluation
copy that is 98% accurate which is updated monthly. MaxMind sells
the GeoIP Country database which has over 99% accuracy and is
updated weekly.
The database comes in two forms:
- GeoIPCountryCSV.zip
- as a compressed (zip) textual file containing the IP range, country name, and county code in a comma separated value (CSV) form
- GeoIP.dat.gz
- as a compressed (gzip) binary file containing an encoded form of the IP address range and country code
OPTIONS
Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.
One of the following switches is required:
- --csv-input
- Treat the standard input as a textual stream containing the CSV (comma separated value) GeoIP country code data.
- --encoded-input
- Treat the standard input as a binary stream the encoded GeoIP country code data.
EXAMPLES
Obtain your copy of the MaxMind GeoIP Country database, either the comma separated value version or the binary version (GeoIP.dat.gz). To create the country_codes.pmap data file, run
-
For the CSV version:
$ unzip -p GeoIPCountryCSV.zip | \
rwgeoip2ccmap --csv-input > country_codes.pmap
For the binary data format:
$ gzip -d -c GeoIP.dat.gz | \
rwgeoip2ccmap --encoded-input > country_codes.pmap
Once you have created the country_codes.pmap file, you will need to copy it to $SILK_PATH/share/silk/country_codes.pmap so that the ccfilter plug-in will use it.