GeoLocation

During the process of creating policy scripts the need may arise to find the geographic location for an IP address. Bro has support for the GeoIP library at the policy script level beginning with release 1.3 to account for this need. To use this functionality, you need to first install the libGeoIP software, and then install the GeoLite city database before building Bro.

Install libGeoIP

  • FreeBSD:

    sudo pkg_add -r GeoIP
    
  • RPM/RedHat-based Linux:

    sudo yum install GeoIP-devel
    
  • DEB/Debian-based Linux:

    sudo apt-get install libgeoip-dev
    
  • Mac OS X:

    Vanilla OS X installations don’t ship with libGeoIP, but if installed from your preferred package management system (e.g. MacPorts, Fink, or Homebrew), they should be automatically detected and Bro will compile against them.

GeoIPLite Database Installation

A country database for GeoIPLite is included when you do the C API install, but for Bro, we are using the city database which includes cities and regions in addition to countries.

Download the GeoLite city binary database.

wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
gunzip GeoLiteCity.dat.gz

Next, the file needs to be put in the database directory. This directory should already exist and will vary depending on which platform and package you are using. For FreeBSD, use /usr/local/share/GeoIP. For Linux, use /usr/share/GeoIP or /var/lib/GeoIP (choose whichever one already exists).

mv GeoLiteCity.dat <path_to_database_dir>/GeoIPCity.dat

Usage

There is a single built in function that provides the GeoIP functionality:

function lookup_location(a:addr): geo_location

There is also the geo_location data structure that is returned from the lookup_location function:

type geo_location: record {
  country_code: string;
  region: string;
  city: string;
  latitude: double;
  longitude: double;
};

Example

To write a line in a log file for every ftp connection from hosts in Ohio, this is now very easy:

global ftp_location_log: file = open_log_file("ftp-location");

event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool)
{
  local client = c$id$orig_h;
  local loc = lookup_location(client);
  if (loc$region == "OH" && loc$country_code == "US")
  {
    print ftp_location_log, fmt("FTP Connection from:%s (%s,%s,%s)", client, loc$city, loc$region, loc$country_code);
  }
}

Next Page

Input Framework

Previous Page

File Analysis

Copyright 2013, The Bro Project. Last updated on July 19, 2016. Created using Sphinx 1.4.4.