search

zmap / zannotate

Utility for annotating Internet datasets with contextual metadata (e.g., origin AS, MaxMind GeoIP2, reverse DNS, and WHOIS)
Apache License 2.0
95 stars 17 forks source link

Added Geolite ASN database parsing. #24

Closed lavalamp- closed 4 years ago

lavalamp- commented 4 years ago

Hi there!

Thank you all so much for your work - I've been a long-time fan.

I added some functionality to parse / process the Geolite ASN database from MaxMind. Looks pretty straightforward and it works locally, but if you'd like me to add anything else just lmk!

zakird commented 4 years ago

Do you have an example output? It's difficult to tell what this looks like offhand because of the interface{} return just handing back the library object.

lavalamp- commented 4 years ago

Do you have an example output? It's difficult to tell what this looks like offhand because of the interface{} return just handing back the library object.

I'll update to have an explicitly populated struct, similar to how geoip2.go does.

lavalamp- commented 4 years ago

Output of new changes:

chris@ubuntu:~/git/zannotate$ cat test.txt  | ./main --geoasn --geoasn-database=geolite_asn.mmdb
{"ip":"8.8.8.8","geoasn":{"asn":15169,"asn_org":"GOOGLE"}}
{"geoasn":{"asn":13335,"asn_org":"CLOUDFLARENET"},"ip":"1.1.1.1"}
lavalamp- commented 4 years ago

Done!

chris@ubuntu:~/git/zannotate$ cat test.txt | ./main --geoasn --geoasn-database=geolite_asn.mmdb
{"ip":"8.8.8.8","geoasn":{"asn":15169,"org":"GOOGLE"}}
{"ip":"1.1.1.1","geoasn":{"asn":13335,"org":"CLOUDFLARENET"}}