No future updates to GeoIP legacy databases

Zeek
1

For those using Bro with libgeoip for IP location data, such as country of origin, Maxmind has announced that March 2018 will be the last update to the free legacy database:

https://dev.maxmind.com/geoip/geoip2/geolite2/
https://blog.hqcodeshop.fi/archives/387-MaxMind-GeoIP-database-legacy-version-discontinued.html

Some options appear to be:

  1. Update Bro to use the new Maxmind library.

  2. In the short term, generate legacy databases from the distributed CSVs for the new format from https://dev.maxmind.com/geoip/geoip2/geolite2/ using code like https://github.com/mteodoro/mmutils or https://github.com/dankamongmen/sprezzos-world/blob/master/packaging/geoip/debian/src/geoip-csv-to-dat.cpp (these would need to be modified to create legacy databases from the new format CSVs)…

  3. Hope someone does #2 above and provides access to those generated databases.

  4. Become a paying customer of Maxmind to continue to access the legacy format databases

  5. Switch to another vendor with free IP location data, such as https://lite.ip2location.com/ - requiring a different library to access

  6. Do nothing, in which case convergence from reality will gradually emerge.

I would be interested in the group’s thoughts about this.

Jim Mellander, ESNet

2

We switched to the paid version of Maxmind here a little over a year ago for faster updates of the DB. The price is very reasonable and its an easy drop in replacement. We user it with Splunk and some other scripts as well as Bro so it was an easy decision for us.

3

Hello,

Last I checked (a few years ago) the Maxmind commercial offering was
pretty expensive, so I am interested to find that may no longer be the
case, if you don't mind how much are you paying Isabelle?

We have been using the db-ip API with other processes for quite a while
now as the free Maxmind GeoIP database is often inaccurate. The db-ip
service is great and the price is super cheap for API use and slightly
more expensive for a DB download which contains necessary data including
LAT and LONG. Been thinking about incorporating db-ip into Splunk and I
guess now Bro - so this news provides motivation to get that done.

https://db-ip.com

Greg