GEOLOOKUP(1)

💅 GEOLOOKUP 💅

okay bestie, so this is geolookup from the General Commands Manual — literally the little tool that tells you where an IP is from and which AS owns it. buckle up 🎀

---

✨ NAME ✨

geolookup — geo location lookup for IP addresses 🌍

---

🦋 SYNOPSIS 🦋

geolookup [-G geoDBfile] [-h] iplist
geolookup -d directory -w geoDBfile

like, two whole modes. one is look stuff up, the other is build the database. both iconic 💅

---

🌸 DESCRIPTION 🌸

okay so geolookup is the tool that looks up AS and geo location info for one or more IP addresses. but before you can use it, you have to create the nfdump specific lookup database first. no database, no vibes. 😭

geolookup is also the thing that builds the nfdump formatted lookup database file out of the maxmind csv files. for that you need a maxmind account over at https://maxmind.com so you can download the relevant csv file. the building instructions are in the section below, don't worry 🫶

here's the cute part: geolookup accepts a list of IP addresses either on the command line, separated by spaces, or on stdin line by line. and the IP on each line can be embedded in a string with spaces on the left and right — so it can literally read the piped output from other tools. main character energy fr fr 👑

geolookup also accepts a list of AS numbers prefixed with as and separated with spaces ✨

the options are as follows:

• -d directory — use the csv files in directory to build the binary lookup database file. with this argument geolookup creates a new binary lookup database file. 🏗️
• -w geoDBfile — name of the new lookup database file.
• -G geoDBfile — use the binary geoDBfile as the lookup database for the current AS and location lookups.
• -h — print help and exit. that's it, that's the whole flag 🎀

so to specify the geo lookup database, geolookup searches at the following places:

• if the default nfdump(1) configuration file exists, it reads the tag geodb.path
• if the environment variable NFGEODB is set, use this setting as lookup database
• the command line argument -G

and if multiple locations are given, here's the priority, lowkey a whole hierarchy bestie:

the environment variable NFGEODB overwrites the nfdump config file, and the command line option -G overwrites the environment variable NFGEODB. 👑

---

💜 ENVIRONMENT 💜

geolookup reads the environment variable NFGEODB 💖

---

⭐ EXIT STATUS ⭐

geolookup returns 0 on success and 255 otherwise. so like, zero is the slay, 255 is the not-slay 💀

---

🔥 EXAMPLES 🔥

okay so to create a lookup database, you need an account at https://maxmind.com. it works with the paid GeoDB as well as with the free GeoLite2 csv files — so there's a free path, we love that for us 🌈

the easiest way for creating or updating the binary lookup database is the use of the script updateGeoDB.sh provided with all other nfdump files. insert your license key and run the script. this creates a new lookup database. easy. ✨

if you want to do it manually, follow these steps:

1. log into https://maxmind.com and download the corresponding csv files: GeoLite2-ASN-CSV and GeoLite2-City-CSV
2. unpack the zip files and put the following csv files into a newly created build directory: GeoLite2-ASN-Blocks-IPv4.csv, GeoLite2-ASN-Blocks-IPv6.csv, GeoLite2-City-Blocks-IPv4.csv, GeoLite2-City-Blocks-IPv6.csv, GeoLite2-City-Locations-en.csv. Maxmind offers several languages for the City-Locations file — choose only one. 🚨 only one, bestie, don't be greedy 🙈
3. geolookup -d builddir -w geofile
4. move the lookup database to the final location. you're done, go brunch 🥂

---

🧚 SEE ALSO 🧚

nfdump has already builtin lookup options to decorate the text output with geo location and AS information. so like, iykyk. 👑

nfdump(1)

---

ngl that's the whole page. go forth and geolocate, queen 🫶

this page came from Debian, version $Mdocdate$ — mwah, enjoy the read, bestie 💅💖