base/bif/mmdb.bif.zeek

GLOBAL

Namespace

GLOBAL

Summary

Functions

lookup_autonomous_system: function	Performs an lookup of AS number & organization of an IP address.
lookup_location: function	Performs a geo-lookup of an IP address.
mmdb_open_asn_db: function	Initializes MMDB for later use of lookup_autonomous_system.
mmdb_open_location_db: function	Initializes MMDB for later use of lookup_location.

Detailed Interface

Functions

lookup_autonomous_system

Type

function (a: addr) : geo_autonomous_system

Performs an lookup of AS number & organization of an IP address. Requires Zeek to be built with libmaxminddb.

Parameters

a – The IP address to lookup.

Returns

A record with autonomous system number and organization that contains a.

See also: lookup_location

lookup_location

Type

function (a: addr) : geo_location

Performs a geo-lookup of an IP address. Requires Zeek to be built with libmaxminddb.

Parameters

a – The IP address to lookup.

Returns

A record with country, region, city, latitude, and longitude.

See also: lookup_autonomous_system

mmdb_open_asn_db

Type

function (f: string) : bool

Initializes MMDB for later use of lookup_autonomous_system. Requires Zeek to be built with libmaxminddb.

Parameters

f – The filename of the MaxMind ASN DB.

Returns

A boolean indicating whether the db was successfully opened.

See also: lookup_autonomous_system

mmdb_open_location_db

Type

function (f: string) : bool

Initializes MMDB for later use of lookup_location. Requires Zeek to be built with libmaxminddb.

Parameters

f – The filename of the MaxMind City or Country DB.

Returns

A boolean indicating whether the db was successfully opened.

See also: lookup_autonomous_system