In article http://www.stableit.ru/2015/04/how-to-enable-geoip-support-in-tshark.html we discuss GeoIP feature. If you interested in AS numbers of client hosts, please execute this reference.
Install GeoIP:
Install GeoIP:
apt-get install -y geoip-databaseThen download ASN database:
wget http://geolite.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gzThen you should specify folder with GeoIP databases to Wireshark:
gunzip GeoIPASNum.dat.gz
mv GeoIPASNum.dat /usr/share/GeoIP/
mkdir -p ~/.wiresharkLet's start:
echo '"/usr/share/GeoIP"' > ~/.wireshark/geoip_db_paths
tshark -i eth0 -n -T fields -e ip.geoip.src_asnum -o "ip.use_geoip: TRUE"And you will get following output:
AS60781 LeaseWeb B.V.
AS34757 Sibirskie Seti Ltd.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS60781 LeaseWeb B.V.
AS200000 Hosting Ukraine LTD
AS60781 LeaseWeb B.V.
AS23947 PT.Mora Telematika Indonesia
AS60781 LeaseWeb B.V.
AS2914 NTT America, Inc.
AS60781 LeaseWeb B.V.
AS18881 Global Village Telecom
No comments :
Post a Comment
Note: only a member of this blog may post a comment.