RWGEOIP2CCMAP(1)

NAME
rwgeoip2ccmap - Create a country code prefix map from a GeoIP data file

SYNOPSIS
  unzip -p GeoIPCountryCSV.zip | \
      rwgeoip2ccmap --csv-input > country_codes.pmap

  gzip -d -c GeoIP.dat.gz | \
      rwgeoip2ccmap --encoded-input > country_codes.pmap

DESCRIPTION
Prefix maps provide a way to map field values to string labels based on a user-defined map file. The country code prefix map, typically named country_codes.pmap, is a special prefix map that maps an IP address to a two-letter country code. It uses the country codes defined by the Internet Assigned Numbers Authority (http://www.iana.org/root-whois/index.html <http://www.iana.org/root-whois/index.html>).

The country code prefix map is used by the ccfilter(3) plug-in to partition by, count by, sort by, and display the country code in SiLK Flow files. The rwip2cc(1) command can use the map file to display the country code for textual IP addresses.

The country code prefix map is based on the GeoIP Country(R) or free GeoLite database created by MaxMind(R) and available from <http://www.maxmind.com/>. The GeoLite database is a free evaluation copy that is "98% accurate" which is updated monthly. MaxMind sells the GeoIP Country database which has over "99% accuracy" and is updated weekly.

The database is available in two formats:

GeoIPCountryCSV.zip
    a compressed (zip) textual file containing the IP range, country name, and county code in a comma separated value (CSV) form. If you download this format, specify --csv-input on the rwgeoip2ccmap command line.

GeoIP.dat.gz
    as a compressed (gzip) binary file containing an encoded form of the IP address range and country code. If you download this format, specify --encoded-input on the rwgeoip2ccmap command line.

OPTIONS
Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

One of the following switches is required:

--csv-input
    Treat the standard input as a textual stream containing the CSV (comma separated value) GeoIP country code data.

--encoded-input
    Treat the standard input as a binary stream the encoded GeoIP country code data.

EXAMPLES
Obtain your copy of the MaxMind GeoIP Country database, either the comma separated value version or the binary version (GeoIP.dat.gz). To create the country_codes.pmap data file, run

•   For the CSV version:

      $ unzip -p GeoIPCountryCSV.zip | \
            rwgeoip2ccmap --csv-input > country_codes.pmap

•   For the binary data format:

      $ gzip -d -c GeoIP.dat.gz | \
            rwgeoip2ccmap --encoded-input > country_codes.pmap

Once you have created the country_codes.pmap file, you will need to copy it to $SILK_PATH/share/silk/country_codes.pmap so that the ccfilter plug-in will use it.

SEE ALSO
ccfilter(3), rwip2cc(1)