# GEOIP **URL:** \ **Category:** Zeek\ **Created:** [September 11, 2008, 12:50pm UTC](https://community.zeek.org/t/geoip/1380 "2008-09-11T12:50:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jim\_Bo](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@Jim\_Bo](https://community.zeek.org/u/Jim_Bo)\ **Post date:** [September 11, 2008, 12:50pm UTC](https://community.zeek.org/t/geoip/1380/1 "2008-09-11T12:50:22Z")
Does anyone have a GeoIP example that will check all http/https connections and log attempts from non XX countries? Thanks, Jimbo ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [September 11, 2008, 1:26pm UTC](https://community.zeek.org/t/geoip/1380/2 "2008-09-11T13:26:57Z")
Checking https connections doesn't make much sense because there are no distinguishing features from any other SSL encrypted session other than maybe the port number, but that's not very definitive. You could watch for SSL sessions in general (using DPD) to sort of catch https sessions. For http, I attached a script I just wrote to do what you want. It takes a list of country codes as a configuration option and will log all requests that aren't going to or coming from one of your defined countries. I haven't tested the code at all (I think it should work), but it should give you a general idea of how to do this. Another concern I have about this script is that I'm not completely sure how well the geoip library can handle extremely high levels of queries against. I've heard in certain circumstances that if you do too many lookups in Bro (many, many thousands per second) it will begin to return incorrect data. So, if you start using this, keep an eye on the data you're getting and make sure it's what you expect.    .Seth [http-geo-logging.bro](https://community.zeek.org/uploads/short-url/2CyneYqpQLMxmnczfRtFdLcM1vK.bro) (856 Bytes) ---
**Author:** ![Jim\_Bo](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@Jim\_Bo](https://community.zeek.org/u/Jim_Bo)\ **Post date:** [September 11, 2008, 4:23pm UTC](https://community.zeek.org/t/geoip/1380/3 "2008-09-11T16:23:31Z")
Thanks for the reply. I have played around with the script but I keep getting the following error: /usr/local/bro/policy/http-entity.bro, line 9: error: unknown identifier lookup\_http\_request\_stream, at or near "lookup\_http\_request\_stream" ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [September 11, 2008, 4:35pm UTC](https://community.zeek.org/t/geoip/1380/4 "2008-09-11T16:35:09Z")
Fixed version. I had several bugs 🙂 [http-geo-logging.bro](https://community.zeek.org/uploads/short-url/eHO8e5iTJit5q6fCbYGvzkgBNeS.bro) (915 Bytes) ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [September 12, 2008, 12:44pm UTC](https://community.zeek.org/t/geoip/1380/5 "2008-09-12T12:44:19Z")
> Is there a way to extract the incoming IP addresses on ports 80 and > 443 and run the IP addresses through GeoIP. That's more or less what the script does that I sent to the list. (except for port 443). I guess I just don't know what end result you're looking to get. > Also is there any sort of > documentation or even books that I can look at / buy that would help > me with this type of stuff so that I dont have to keep bothering you. The best current documentation is in the slides and related exercises from Bro workshop that took place last summer.      [http://bro-ids.org/wiki/index.php/WorkshopMaterial](http://bro-ids.org/wiki/index.php/WorkshopMaterial) A \*little\* bit of documentation about the libGeoIP support can be found here:      [http://bro-ids.org/wiki/index.php/GeoLocation](http://bro-ids.org/wiki/index.php/GeoLocation) There is also a lot of good material to be found in the manuals:      [http://bro-ids.org/wiki/index.php/User\_Manual](http://bro-ids.org/wiki/index.php/User_Manual)      [http://bro-ids.org/wiki/index.php/Reference\_Manual](http://bro-ids.org/wiki/index.php/Reference_Manual) Hopefully that helps. Feel free to keep asking questions though.    .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/geoip/1380/6 "2022-05-06T15:38:38Z")