Jan 9, 2014

IP geolocation from command line on OSX

Internet contains zillion of sites bloated with banners, which basically give you the same data: given the IP address, provide some info on where this IP is coming from.

Same basic information can be accessed from command line, here is how you configure it, assuming your OSX machine has brew/port, and can compile C source code.

This will install geoiplookup utility:
git clone https://github.com/maxmind/geoip-api-c.git
cd geoip-api-c/
autoreconf -ivf
./configure
make
sudo make install

Now we need the actual GeoIP databases that utility will use. You can buy more accurate data, but we'll use the free, less accurate for now:

cd /tmp/
curl -O http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
curl -O http://geolite.maxmind.com/download/geoip/database/GeoIPv6.dat.gz
curl -O http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
curl -O http://geolite.maxmind.com/download/geoip/database/GeoLiteCityv6-beta/GeoLiteCityv6.dat.gz
curl -O http://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz
curl -O http://download.maxmind.com/download/geoip/database/asnum/GeoIPASNumv6.dat.gz

find . -name "Geo*.gz" | xargs -I {} gunzip {}
mv GeoLiteCityv6.dat GeoIPCityv6.dat
mv GeoLiteCity.dat GeoIPCity.dat

sudo mv Geo*.dat /usr/local/share/GeoIP/

Sample run:
geoiplookup 8.8.8.8

GeoIP Country Edition: US, United States
GeoIP City Edition, Rev 1: US, N/A, N/A, N/A, N/A, 38.000000, -97.000000, 0, 0
GeoIP ASNum Edition: AS15169 Google Inc.

1 comment:

Anonymous said...

On my install of Mac OSX xargs needed to be replaced by gxargs after installing the GNU findutils. The -I option seems to be different when given an empty string.
It's an easy fix to 'port install findutils' (Or brew or whatever). Then change xargs to gxargs.