Actions
Feature #559
closedgeoip keyword
Effort:
Difficulty:
Label:
Description
Often requested: add geoip support. A keyword would be nice:
geoip:US;
Or something similar.
Updated by Ignacio Sanchez about 12 years ago
Would the MaxMind GeoLite Country DB be OK for this?
They seem to have good accuracy and performance, and the c libraries are widely available for windows and included in most of the current Linux distributions.
Updated by Victor Julien about 12 years ago
Yeah that seems to be a sane choice. Performance is probably ok if combined with other rule keywords.
Updated by Ignacio Sanchez about 12 years ago
- Assignee changed from Anonymous to Ignacio Sanchez
Updated by Victor Julien almost 12 years ago
- Status changed from New to Closed
- Target version changed from TBD to 1.4.1
Merged https://github.com/inliniac/suricata/pull/247, thanks a lot!
Actions