Actions
Feature #559
closed
VJ
IS
geoip keyword
Feature #559:
geoip keyword
Effort:
Difficulty:
Label:
Description
Often requested: add geoip support. A keyword would be nice:
geoip:US;
Or something similar.
VJ Updated by Victor Julien over 13 years ago
- Target version set to TBD
IS Updated by Ignacio Sanchez over 13 years ago
Would the MaxMind GeoLite Country DB be OK for this?
They seem to have good accuracy and performance, and the c libraries are widely available for windows and included in most of the current Linux distributions.
VJ Updated by Victor Julien over 13 years ago
Yeah that seems to be a sane choice. Performance is probably ok if combined with other rule keywords.
IS Updated by Ignacio Sanchez over 13 years ago
- Assignee changed from Anonymous to Ignacio Sanchez
VJ Updated by Victor Julien about 13 years ago
- Status changed from New to Closed
- Target version changed from TBD to 1.4.1
Merged https://github.com/inliniac/suricata/pull/247, thanks a lot!
Actions