geo locate tshark ip address

asked 2019-04-11 18:25:14 +0000

Once I have redirected a tshark file to Excel, is there a way to - geographically by country - geo locate/attribute an IP address directly from Excel preferably without any programming.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-04-11 20:57:11 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

Due to Bug 14691 - tshark does not print GeoIP information, you may not be able to reliably accomplish this with tshark yet; however, you should be able to use Wireshark.

Steps:

Open capture file
Statistics -> Endpoints
Copy -> as CSV
Open new, empty text file
Paste copied data into new file
Save file with .csv extension
Open file in Excel

Once Bug 14691 is resolved, then you should be able to use tshark. Check the man page for more options, but a simple example might be:

tshark -r file.pcap -T fields -E separator=, -E quote=d -e ip.src -e ip.geoip.src_country  -e ip.geoip.src_city -e ip.dst -e ip.geoip.dst_country -e ip.geoip.dst_city > file.csv

Add as many fields as you wish using repeated -e options. You can check the Wireshark Internet Protocol Version 4 Display Filter Reference page for other geoip-related fields you might be interested in.

edit flag offensive delete link

Comments

Hi. Thank you for your comments. I have been using your example: tshark -r file.pcap - T fields -E separator=... and it works well directly from the command line...no bugs. It sends the file to Excel and displays it...works well. So what I would like to do is geo locate the ip address from Excel. According to the "Overview Method" description in this link: https://labs.mwrinfosecurity.com/blog... ...it is possible. Are you familiar with this; is there an easier way ??

[email protected] ( 2019-04-12 16:32:25 +0000 )edit

I'm not familiar with doing this from within Excel, but if Wireshark is already providing you with the lookup information, I don't really see the need. If that's what you want though, and you're having difficulties with it, then maybe try contacting MWR Infosecurity for help with it?

cmaynard ( 2019-04-12 16:54:44 +0000 )edit

I will try with your "complete" example as you typed it. No reason why it shouldn't work.

[email protected] ( 2019-04-12 16:58:18 +0000 )edit

Hi. I tested: tshark -r test.pcap -T fields -E header=y -E separator=, -e ip.src -e ip.geoip.src_country ...the command displays the source ip address and the port..only...syntax issue ?? I'm working with tshark version 3.0.0...Can I ask you to test the command in your PC and let me know what you get ??

[email protected] ( 2019-04-13 17:53:17 +0000 )edit

add a comment

answered 2019-04-11 21:00:06 +0000

SYN-bit

18528 ●9 ●338 ●255 https://SYN-b.it

Why not use the GeoIP functionality of tshark/wireshark?

See:

https://blog.packet-foo.com/2018/05/w...
https://blog.packet-foo.com/2013/05/w... (for wireshark up to 2.4.x)

edit flag offensive delete link

Comments

I've been using the update_geoip.bat file I wrote and posted on the Wireshark Toolswiki page to download the Maxmind database files. The batch file was inspired by Jasper's [UpdateGeoIPDB.cmd] (https://github.com/packetfoo/GeoIPDBU...) file, but has some enhancements to it, such as not actually downloading the files if you already have the latest versions, and using built-in Windows tools to try to avoid additional dependencies if possible, to name a couple. Run update_geoip.bat -h for help or just view the batch file in any text editor to see what it does.

I had assumed that the person asking the question already had the Maxmind database files and had already configured Wireshark to use them, but if not then obviously that is required first. Getting the database files and configuring Wireshark is only the first step though; my answer describes how to get the ...(more)

cmaynard ( 2019-04-11 21:17:45 +0000 )edit

I was just testing with tshark and discovered the problem with GeoIP problems in tshark outlined in bug 14691 :-)

SYN-bit ( 2019-04-11 21:29:24 +0000 )edit

Hi. I'm new to tshark. How do I look at bug 14691? What did you discover in 14691? I tested: tshark -r test.pcap -T fields -E separator=, -E quote=d -e ip.src -e ip.geoip.src_country...it displays the source ip address and the port..only...in version 3.0.0 of tshark.

[email protected] ( 2019-04-13 18:13:27 +0000 )edit

See the first line of @cmaynard 's answer, it has the link to the bug. Basically, the way name (and GeoIP) resolving works in wireshark is not working (well) for tshark, hence, no GeoIP data is displayed when using tshark.

SYN-bit ( 2019-04-14 11:03:44 +0000 )edit

add a comment