userguide: update geoip information

Signed-off-by: jason taylor <jtfas90@gmail.com>
pull/8165/head
jason taylor 2 years ago committed by Victor Julien
parent e8eba6e4a1
commit 4be9793e36

@ -163,7 +163,7 @@ Example of id in a rule:
geoip
^^^^^
The geoip keyword enables (you) to match on the source, destination or
The geoip keyword enables matching on the source, destination or
source and destination IPv4 addresses of network traffic, and to see to
which country it belongs. To be able to do this, Suricata uses the GeoIP2
API of MaxMind.
@ -176,22 +176,19 @@ The syntax of geoip::
geoip: both,US,CA,UK;
geoip: any,CN,IR;
So, you can see you can use the following to make clear on which
direction you would like to match
====== =============================================================
Option Description
====== =============================================================
both Both directions have to match with the given geoip(s)
any One of the directions has to match with the given geoip(s).
dest If the destination matches with the given geoip.
both Both source and destination have to match with the given geoip(s)
any Either the source or the destination has to match with the given geoip(s).
dest The destination matches with the given geoip.
src The source matches with the given geoip.
====== =============================================================
The keyword only supports IPv4. As it uses the GeoIP2 API of MaxMind,
geoip currently only supports IPv4. As it uses the GeoIP2 API of MaxMind,
libmaxminddb must be compiled in. You must download and install the
GeoIP2 or GeoLite2 database editions desired. Visit the MaxMind site
at https://dev.maxmind.com/geoip/geoip2/geolite2/ for details.
at https://dev.maxmind.com/geoip/geolite2-free-geolocation-data for details.
You must also supply the location of the GeoIP2 or GeoLite2 database
file on the local system in the YAML-file configuration (for example)::

Loading…
Cancel
Save