topic Re: How to add own IP locations into the GeoLite2-City.mmdb in Splunk Search

How to add own IP locations into the GeoLite2-City.mmdb

graether — Mon, 20 Aug 2018 06:57:02 GMT

Hello,

I applied successfully the tool at

github Customizing-Maxmind-IP-Geo-DB-for-Internal-Networks

https://github.com/threatstream/mhn/wiki/Customizing-Maxmind-IP-Geo-DB-for-Internal-Networks]

to add own IPs for an important Enterprise Security Projekt.

But somehow the mmdb created by

python csv2dat.py -w mmcity.dat mmcity GeoLiteCity-and-mynetworks.csv

differs from Splunks internal GeoLite2-City.mmdb

>>> import pygeoip, json
>>> geo = pygeoip.GeoIP('GeoLite2-City.mmdb')
>>> print json.dumps(geo.record_by_addr('182.236.164.11'), indent=4, sort_keys=True)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/root/mmutils/env/lib/python2.7/site-packages/pygeoip/__init__.py", line 544, in record_by_addr
    raise GeoIPError(message)
pygeoip.GeoIPError: Invalid database type, expected City

Is there a better method? Did I miss another conversion step?

Thanks!

Re: How to add own IP locations into the GeoLite2-City.mmdb

niketn — Mon, 20 Aug 2018 07:13:36 GMT

Refer to the following repository for updating MaxMind DB in Splunk:

https://www.splunk.com/blog/2014/07/22/updating-the-iplocation-db.html
http://www.georgestarcher.com/splunk-updating-the-geoip-database/

Re: How to add own IP locations into the GeoLite2-City.mmdb

graether — Mon, 20 Aug 2018 07:27:39 GMT

Thanks, but I need to put my own IPs into the database, as explained in Customizing-Maxmind-IP-Geo-DB-for-Internal-Networks

Re: How to add own IP locations into the GeoLite2-City.mmdb

MuS — Mon, 20 Aug 2018 08:45:13 GMT

A quick Google search reveals that the above script creates a .dat binary file and the file you used is a .mmdb which is the newer version. Another quick Google search reveals that there are many tools, topics how to convert a .dat file to a .mmdb

Try this https://www.google.com/search?q=python+convert+mmdb+to+dat

cheers, MuS

Re: How to add own IP locations into the GeoLite2-City.mmdb

graether — Mon, 20 Aug 2018 09:14:30 GMT

Thanks MuS for pointing this out!
Somehow this

https://blog.maxmind.com/2015/09/29/building-your-own-mmdb-database-for-fun-and-profit/

looks promising, and I'll give it a try.

Cheers

Re: How to add own IP locations into the GeoLite2-City.mmdb

tiago_comasseto — Fri, 09 Nov 2018 14:25:56 GMT

Hi @graether, we're trying to do the same with our internal IP's. Did you get any progress with the .mmdb file?

Thanks

Re: How to add own IP locations into the GeoLite2-City.mmdb

graether — Mon, 12 Nov 2018 09:12:25 GMT

Hello Tiago,

I did not need to edit the file .mmdb anymore due to a project scope change. I've started with
https://blog.maxmind.com/2015/09/29/building-your-own-mmdb-database-for-fun-and-profit/
but was not so straightforward. So unfortunately no news from my side.