Suricata geoIP DB



  • Hello,

    1. Is there a way I can force update the Suricata geoIP DB?

    2. Can I modify a country list…lets say geoip:us,... I would like to add some IPs to it?

    Thanks.

    F.



  • @fsansfil:

    Hello,

    1. Is there a way I can force update the Suricata geoIP DB?

    Yes, you can manually do this from the command line.  Execute this command at a shell prompt –

    
    cd /usr/local/pkg/suricata && php suricata_geoipupdate.php
    
    

    @fsansfil:

    1. Can I modify a country list…lets say geoip:us,... I would like to add some IPs to it?

    Well, I guess you might could manually do this if you understand the internal structure of the GeoIP database files.  Any change would be overwritten with the next scheduled update, though.  I don't know the internal structure of those files.

    Bill


Log in to reply