base/bif/mmdb.bif.zeek

GLOBAL
Namespace

GLOBAL

Summary

Functions

lookup_autonomous_system: function

Performs an lookup of AS number & organization of an IP address.

lookup_location: function

Performs a geo-lookup of an IP address.

mmdb_open_asn_db: function

Initializes MMDB for later use of lookup_autonomous_system.

mmdb_open_location_db: function

Initializes MMDB for later use of lookup_location.

Detailed Interface

Functions

lookup_autonomous_system
Type

function (a: addr) : geo_autonomous_system

Performs an lookup of AS number & organization of an IP address. Requires Zeek to be built with libmaxminddb.

Parameters

a – The IP address to lookup.

Returns

A record with autonomous system number and organization that contains a.

See also: lookup_location

lookup_location
Type

function (a: addr) : geo_location

Performs a geo-lookup of an IP address. Requires Zeek to be built with libmaxminddb.

Parameters

a – The IP address to lookup.

Returns

A record with country, region, city, latitude, and longitude.

See also: lookup_autonomous_system

mmdb_open_asn_db
Type

function (f: string) : bool

Initializes MMDB for later use of lookup_autonomous_system. Requires Zeek to be built with libmaxminddb.

Parameters

f – The filename of the MaxMind ASN DB.

Returns

A boolean indicating whether the db was successfully opened.

See also: lookup_autonomous_system

mmdb_open_location_db
Type

function (f: string) : bool

Initializes MMDB for later use of lookup_location. Requires Zeek to be built with libmaxminddb.

Parameters

f – The filename of the MaxMind City or Country DB.

Returns

A boolean indicating whether the db was successfully opened.

See also: lookup_autonomous_system