Suricata geoIP DB

[fsansfil]

Hello,

1. Is there a way I can force update the Suricata geoIP DB?

2. Can I modify a country list…lets say geoip:us,... I would like to add some IPs to it?

Thanks.

F.

[bmeeks]

@fsansfil:

Hello,

1. Is there a way I can force update the Suricata geoIP DB?

Yes, you can manually do this from the command line.  Execute this command at a shell prompt –

cd /usr/local/pkg/suricata && php suricata_geoipupdate.php

@fsansfil:

2. Can I modify a country list…lets say geoip:us,... I would like to add some IPs to it?

Well, I guess you might could manually do this if you understand the internal structure of the GeoIP database files.  Any change would be overwritten with the next scheduled update, though.  I don't know the internal structure of those files.

Bill