Monday 3 December 2018

Geo-location with Wireshark and Geolite2

Turns out Wireshark has built in ASN, City and Country geo-location using Geoip products. You can purchase a (presumably) more accurate version, or use the free version from here:
https://dev.maxmind.com/geoip/geoip2/geolite2/

More details on the Wireshark Wiki (GeoIP link appears broken):
https://wiki.wireshark.org/HowToUseGeoIP

You can get endpoint statistics:

And in capture:


No comments:

Post a Comment