Ask Your Question
0

geo locate tshark ip address

asked 2019-04-11 18:25:14 +0000

rvelez3@fau.edu gravatar image

Once I have redirected a tshark file to Excel, is there a way to - geographically by country - geo locate/attribute an IP address directly from Excel preferably without any programming.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
2

answered 2019-04-11 20:57:11 +0000

cmaynard gravatar image

Due to Bug 14691 - tshark does not print GeoIP information, you may not be able to reliably accomplish this with tshark yet; however, you should be able to use Wireshark.

Steps:

  1. Open capture file
  2. Statistics -> Endpoints
  3. Copy -> as CSV
  4. Open new, empty text file
  5. Paste copied data into new file
  6. Save file with .csv extension
  7. Open file in Excel

Once Bug 14691 is resolved, then you should be able to use tshark. Check the man page for more options, but a simple example might be:

tshark -r file.pcap -T fields -E separator=, -E quote=d -e ip.src -e ip.geoip.src_country  -e ip.geoip.src_city -e ip.dst -e ip.geoip.dst_country -e ip.geoip.dst_city > file.csv

Add as many fields as you wish using repeated -e options. You can check the Wireshark Internet Protocol Version 4 Display Filter Reference page for other geoip-related fields you might be interested in.

edit flag offensive delete link more

Comments

Hi. Thank you for your comments. I have been using your example: tshark -r file.pcap - T fields -E separator=... and it works well directly from the command line...no bugs. It sends the file to Excel and displays it...works well. So what I would like to do is geo locate the ip address from Excel. According to the "Overview Method" description in this link: https://labs.mwrinfosecurity.com/blog... ...it is possible. Are you familiar with this; is there an easier way ??

rvelez3@fau.edu gravatar image[email protected] ( 2019-04-12 16:32:25 +0000 )edit

I'm not familiar with doing this from within Excel, but if Wireshark is already providing you with the lookup information, I don't really see the need. If that's what you want though, and you're having difficulties with it, then maybe try contacting MWR Infosecurity for help with it?

cmaynard gravatar imagecmaynard ( 2019-04-12 16:54:44 +0000 )edit

I will try with your "complete" example as you typed it. No reason why it shouldn't work.

rvelez3@fau.edu gravatar image[email protected] ( 2019-04-12 16:58:18 +0000 )edit

Hi. I tested: tshark -r test.pcap -T fields -E header=y -E separator=, -e ip.src -e ip.geoip.src_country ...the command displays the source ip address and the port..only...syntax issue ?? I'm working with tshark version 3.0.0...Can I ask you to test the command in your PC and let me know what you get ??

rvelez3@fau.edu gravatar image[email protected] ( 2019-04-13 17:53:17 +0000 )edit
0

answered 2019-04-11 21:00:06 +0000

SYN-bit gravatar image

Why not use the GeoIP functionality of tshark/wireshark?

See:

edit flag offensive delete link more

Comments

I've been using the update_geoip.bat file I wrote and posted on the Wireshark Toolswiki page to download the Maxmind database files. The batch file was inspired by Jasper's [UpdateGeoIPDB.cmd] (https://github.com/packetfoo/GeoIPDBU...) file, but has some enhancements to it, such as not actually downloading the files if you already have the latest versions, and using built-in Windows tools to try to avoid additional dependencies if possible, to name a couple. Run update_geoip.bat -h for help or just view the batch file in any text editor to see what it does.

I had assumed that the person asking the question already had the Maxmind database files and had already configured Wireshark to use them, but if not then obviously that is required first. Getting the database files and configuring Wireshark is only the first step though; my answer describes how to get the ...(more)

cmaynard gravatar imagecmaynard ( 2019-04-11 21:17:45 +0000 )edit

I was just testing with tshark and discovered the problem with GeoIP problems in tshark outlined in bug 14691 :-)

SYN-bit gravatar imageSYN-bit ( 2019-04-11 21:29:24 +0000 )edit

Hi. I'm new to tshark. How do I look at bug 14691? What did you discover in 14691? I tested: tshark -r test.pcap -T fields -E separator=, -E quote=d -e ip.src -e ip.geoip.src_country...it displays the source ip address and the port..only...in version 3.0.0 of tshark.

rvelez3@fau.edu gravatar image[email protected] ( 2019-04-13 18:13:27 +0000 )edit

See the first line of @cmaynard 's answer, it has the link to the bug. Basically, the way name (and GeoIP) resolving works in wireshark is not working (well) for tshark, hence, no GeoIP data is displayed when using tshark.

SYN-bit gravatar imageSYN-bit ( 2019-04-14 11:03:44 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

2 followers

Stats

Asked: 2019-04-11 18:25:14 +0000

Seen: 1,300 times

Last updated: Apr 11 '19