ip geolocation

[anpic]

please add support for geolocation resolving remote ip addresses locally
maybe via maxmind database

[domcyrus]

Hi @anpic , thanks for your issue. I'm not sure I can implement that, because maxmind doesn't have a free open source database. AFAIK you are not allowed to bundle the maxmind database.

[anpic]

I'm not sure I can implement that, because maxmind doesn't have a free open source database

https://github.com/P3TERX/GeoLite.mmdb

you can only make support for the cli flag to indicate the path to the folder or to the database file, and we will download the database ourselves 😊
and maybe there are some other open databases for which you can make cli support

[anpic]

maybe this can help too
https://github.com/GyulyVGC/sniffnet/tree/main/src/mmdb
https://github.com/GyulyVGC/sniffnet/tree/main/src/countries

[domcyrus]

@anpic I see, I find it a bit annoying if users have to download it manually from maxmind and put it somewhere. I'm still pretty sure you can't just add those geoip db files, unless you have the ok from maxmind. If you like you could ask the sniffnet maintainer, how he got maxmind to approve this or asking maxmind directly if we are allowed to do this? If we are allowed to add them into the repo, I would certainly spend some time to this feature.

[anpic]

how he got maxmind to approve this or asking maxmind directly if we are allowed to do this?

but everyone adds them as they want 😏
look at this project
https://github.com/emanuele-f/PCAPdroid
there's actually a commercial version
but I don't think you need to think about it at all
just add cli options to specify paths and everything else is our problems 😎

[domcyrus]

Ook, I'll try to look into although just to make it clear that it won't be my prio1. That said PRs are welcome :)

[vmovupd]

Addition of mmdb database to rustnet would cause size of rustnet package in the repositories to grow significantly. For instance, current package size of rustnet in Arch Linux repository is 1.3 MB and installed size is 4.1 MB. Latest GeoLite2 Country database is ~10 MB, while GeoLite2 City database takes up to 60 MB.

According to EULA, usage of GeoLite2 requires attribution to MaxMind (CC BY-SA 4.0 referenced in EULA). It also places a few restrictions on the use of GeoLite2 database which, to the best of my knowledge and in reference to the clause 6(a), shall be conveyed to end-users (users of rustnet).

Also clause 6(c) shall be considered which ultimately states that GeoLite2 database(s) shall be updated within 30 days with destruction of the old databases:

Destructions of GeoLite2 Database and GeoLite2 Data. From time to time, MaxMind will release an updated version of the GeoLite2 Databases, and you agree to promptly use the updated version of the GeoLite2 Databases. You shall cease use of and destroy (i) any old versions of the Services within thirty (30) days following the release of the updated GeoLite2 Databases; and (ii) all Services immediately upon termination of the license under this Agreement. Upon request, you shall provide MaxMind with written confirmation of such destruction.

For sniffnet, which was mentioned earlier, the geolocation is arguably the main feature as sniffnet, contrary to rustnet, does not show the process, making connection, and, from my quick observations, has troubles with figuring out domain names. Bonus: package size for sniffnet is 17 MB in Arch Linux repository, while installed size is 44 MB.

IMHO, a better tool (or its part?) to compare, despite its not being available on GNU/Linux, would be systeminformer's network tab. System Informer has an ability to configure MaxMind GeoLite Account ID and License Key, so that mmdb database is downloaded by the end-user who wants to use this feature (although System Informer can also use GeoLite database from its %APPDATA%\SystemInformer directory as well). Such implementation would keep rustnet package in the repositories small while allowing the users to set up geolocation lookup thingy if they want to. Also, maxminddb crate is already available from one of the employees at MaxMind under ISC license.

Still, rustnet, just as System Informer's network tab and contrary to sniffnet, does not keep the history of connections. Under such circumstances, it is unclear to me, how the addition of geolocation column would help if most of the connections disappear after a few seconds.

EDIT: It could be useful with --json-log tho to analyze the data further with jq.

[anpic]

would cause size of rustnet package

you probably didn't understand 😉
no one is going to embed the database directly into the binary or even just add it next to the package
it's just about supporting the new command line flag ☺️

According to EULA, usage of GeoLite2 requires attribution to MaxMind

therefore there will be no usage 😁
there should just be support for the new command line flag

[anpic]

System Informer has an ability to configure MaxMind GeoLite Account ID and License Key

this is a bad idea 😕
in this case need to additionally support for their accounts

It could be useful with --json-log tho to analyze the data further

and so it will be ☺️

[domcyrus]

Note: with the --pcap-export feature in #137 you will be able to use Wireshark's GeoIP capabilities on the captured packets if you have mmdb configured there.

Once GeoIP is added to rustnet, we could also include the country/city info in the PCAP sidecar JSONL file so the geographic data is preserved alongside the process info.

[anpic]

with the --pcap-export feature

wow 🔥
can we use both export to json and export to pcap at the same time?

Once GeoIP is added to rustnet, we could also include the country/city info in the PCAP sidecar JSONL file so the geographic data is preserved alongside the process info.

you're making the best network monitor in the world 💫

[domcyrus]

with the --pcap-export feature

wow 🔥 can we use both export to json and export to pcap at the same time?

Yep, you can use both at the same time.

Once GeoIP is added to rustnet, we could also include the country/city info in the PCAP sidecar JSONL file so the geographic data is preserved alongside the process info.

you're making the best network monitor in the world 💫

Heh, thanks a lot :)