Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Point to newer geoip-conn that has the latest data and also now includes ASNs #16

Merged
merged 1 commit into from
Apr 17, 2024

Conversation

philrz
Copy link
Contributor

@philrz philrz commented Apr 17, 2024

Now that brimdata/geoip-conn#48 has merged to support ASNs and brimdata/geoip-conn#49 has merged to include the ASN databases in the geop-conn Zeek packages, this PR advances the pointer to start using that more recent geoip-conn in our Zeek artifacts such that the ASN data will be included for pcaps processed by Brimcap/Zui going forward. Here's an example of it doing its thing using an artifact from this Actions run that was build using commit 559e2f5 from this branch.

$ cat ~/pcap/wrccdc.pcap | ./zeekrunner -

$ zq -Z 'geo.resp.as_number != null | head 1' conn.log 
{
    _path: "conn",
    ts: 2018-03-23T19:58:23.222228Z,
    uid: "C4qVti4oLGTPsUvcGk",
    id: {
        orig_h: 10.47.2.155,
        orig_p: 52821 (port=uint16),
        resp_h: 172.217.11.78,
        resp_p: 443 (port)
    },
    proto: "tcp" (=zenum),
    service: null (string),
    duration: 1.468ms,
    orig_bytes: 31 (uint64),
    resp_bytes: 0 (uint64),
    conn_state: "SF",
    local_orig: true,
    local_resp: false,
    missed_bytes: 0 (uint64),
    history: "DTFfA",
    orig_pkts: 6 (uint64),
    orig_ip_bytes: 374 (uint64),
    resp_pkts: 2 (uint64),
    resp_ip_bytes: 104 (uint64),
    tunnel_parents: null (|[string]|),
    geo: {
        orig: {
            country_code: null (string),
            region: null (string),
            city: null (string),
            latitude: null (float64),
            longitude: null (float64),
            as_number: null (uint64),
            as_org: null (string)
        },
        resp: {
            country_code: "US",
            region: null (string),
            city: null (string),
            latitude: 37.751,
            longitude: -97.822,
            as_number: 15169 (uint64),
            as_org: "GOOGLE"
        }
    },
    community_id: "1:V0dJfyHPUpu2ANb/x4OSlXp9QdA="
}

@philrz philrz requested review from mattnibs and nwt April 17, 2024 18:46
@philrz philrz self-assigned this Apr 17, 2024
@philrz philrz merged commit d57d866 into main Apr 17, 2024
6 of 9 checks passed
@philrz philrz deleted the use-geoip-asn branch April 17, 2024 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants