Pergunta

I use GeoLite from MaxMind. My real task is to determine CityId in our system by specific IP. In MaxMind I find locid by IP and then use hand-maded table of cross between locid and our CityId. But this cross-table is uncompleted. I found good file of localization from MaxMind where each locid mapped to GeoNames id. GeoNames id it's good for me, but this file is uncompleted. For example, there is no Birmingham in this file. So, has anybody such problem? And if any ways to decide it?

Foi útil?

Solução

MaxMind's GeoLite2 databases return GeoNames IDs.

Outras dicas

This is a three parter which gives you all desired output. up to you to wrap it but all city info is provided. by reverse lookup of lon lat and iprange.

It takes python GeoIP example for 1 IP lookup. Then strips the IP ranges. Looks up each range. Then tags its city / lon lat. This is not every IP in every city. But it will give you the main providers and a pretty close if not entirely accurate estimation of what city they are in or next to.

1)

#!/usr/bin/python
import GeoIP
gi = GeoIP.open("/bin/script/tbl/state/GeoLiteCity.dat",GeoIP.GEOIP_STANDARD)

with open ("city.txt", "r") as myfile:
    data=myfile.read().replace('\n', '')
gir = gi.record_by_addr(data)

if gir != None:
        print gir['city']
        print gir['region']
        print gir['region_name']
        print gir['latitude']
        print gir['longitude']

2)

#!/bin/bash
cd /bin/script/tbl/state
for state in $(cat state.abrv); do
 state=$(echo $state)
 cat outputfile | grep $state | cut -f1 -d"," > SB
 output=sb.csv
 echo "ip,country" > $output

 for  i in $( cat SB ); 
  do echo "$i,\"$( geoiplookup -f GeoLiteCity.dat $i -i | cut -d' ' -f4-99 )\"" >> $output 
 done

 echo "a" > sb1.csv && echo "a" >> sb1.csv && echo "a" >> sb1.csv
 cat sb.csv >> sb1.csv

 awk 'NR == 1 || NR % 7 == 0' sb1.csv | tr -d ' ' | tr '-' '/' > sb.csv
 tail -n +2 "sb.csv" > $state

 rm SB sb.csv sb1.csv
done

you can then generate a quick loadable script for iptables like so. This creates a new chain so you can drop a catch all first. Python will load these to the top of the chain. You can then continue setting your primary chain without having to wait 30 minutes for this to load. (depending on your computer of course)

#IPT=/sbin/iptables
#ACT=/bin/script/tbl/state/active.txt
#Py=/usr/bin/python
#suba='p=subprocess.Popen(["'
#subb='"],?stdout?=?subprocess.PIPE)'
#sub2='output?,?err?=?p.communicate()'
#sub3='print?output'
# 
#### Any Changes?
#if diff 'active.txt' 'active.old' > /dev/null; then
#    echo 'Loading Group Interests'
#    /bin/bash state.bash
#    $Py state.py
#    exit
#else
#    echo 'Modifying Rules For'
#    echo $(diff active.txt active.old | head -50 | tail -49 | cut -f2 -d'0')
#fi
#
### Then lets go
#   echo '#!/bin/bash' > state.bash
#   echo '#!/usr/bin/python' > state.py
#   echo 'import?subprocess' >> state.py
#
#for state in $(cat $ACT)
#do
#   echo $IPT' -N '$state >> state.bash
#   echo $IPT' -A '$state' -j DROP' >> state.bash
#done
#/bin/bash state.bash
#
#for state in $(cat $ACT)
#do
#        BADIPS=$(egrep -v -E "^#|^$" $state |  sed 's/[A-Za-z]*//g' | tr -d ":")
#        for ip in $BADIPS
#        do
#                echo $ip | cut -f1 -d'/' > city.txt
# $Py city.py | head -4 | tail -1 > lon.ip
#                $Py city.py | head -5 | tail -1 > lat.ip
#                city=$(cat city.ip | tr ' ' '_')
#                lon=$(cat lon.ip)
#                lat=$(cat lat.ip)
#                echo $suba'iptables -A INPUT -s '$ip' -j '$state$subb >> state.py
#                echo $sub2 >> state.py
#                echo $sub3 >> state.py
#                echo $suba'iptables -A FORWARD -s '$ip' -j '$state$subb >> state.py
#                echo $sub2 >> state.py
#                echo $sub3 >> state.py
#                echo $suba'iptables -A OUTPUT -d '$ip' -j '$state$subb  >> state.py
#                echo $sub2 >> state.py
#                echo $sub3 >> state.py
#                echo $suba"iptables -A "$state" -s "$ip" -j LOG --log-prefix \  
#'STATE_,"$ip","$state","$city","$lon":"$lat",_OUT_:'"$subb >> state.py
#                echo $sub2 >> state.py
#                echo $sub3 >> state.py
#                echo $suba"iptables -A "$state" -d "$ip" -j LOG --log-prefix \
#'STATE_,"$ip","$state","$city","$lon":"$lat",_IN_:'"$subb >> state.py
#                echo $sub2 >> state.py
#  echo $sub3 >> state.py
#                echo $suba"iptables -A "$state" -s "$ip" -j LOG --log-prefix    \
    'STATE_,"$ip","$state","$city","$lon":"$lat",_OUT_:'"$subb >> state.py

#                echo $sub2 >> state.py
#                echo $sub3 >> state.py
#                echo $suba"iptables -A "$state" -d "$ip" -j LOG --log-prefix    #'STATE_,"$ip","$state","$city","$lon":"$lat",_IN_:'"$subb >> state.py
#                echo $sub2 >> state.py
#                echo $sub3 >> state.py
#        done
#done

### MAGIC
sed 's/ /"','"/g' state.py > state1.py
cat state1.py | tr '?' ' ' > state.py

sleep 3
python state.py
cat active.txt > active.old

### adapting this to ASN or country is way easier.
### your welcome
### last time I post anything on this webpage.  There is NOTHING wrong with my formatting. go cry about it

I couldn't match geoname_id and registered_country_geoname_id for country in the maxmind database geolite2 until I found this:

https://www.kaggle.com/geonames/geonames-database?select=geonames.csv

Licenciado em: CC-BY-SA com atribuição
Não afiliado a StackOverflow
scroll top