Wireshark · Wireshark-dev: [Wireshark-dev] [GeoIP] New map of IP locations

[Ulf Lamping <ulf.lamping@xxxxxx>]

Hi!

The new Wireshark "IP Location Map"!

Wireshark can now open a (local) web map page, that displays the 
geolocations of captured IP addresses. I've attached a screenshot how 
this looks like.



What you'll need:
a) An Internet connection
Please note: This mechanism will NOT transfer any sensitive data to the 
internet!

b) Wireshark can open the webbrowser
the menu item Help/Website should open a webpage

c) Webbrowser must have javascript enabled

d) The GeoIP databases must be installed (see below)


Prepare GeoIP databases:
e) Download the GeoIP database files:
http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
http://geolite.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz

f) Put the UNZIPPED files GeoIP.dat, GeoIPASNum.dat and GeoLiteCity.dat 
somewhere into one folder, e.g. into c:\GeoIP

g) Set the "GeoIP database directories" setting in the Preferences "Name 
Resolution" page to the above dir


To try it:
l) Load a capture file into wireshark that contains IP addresses from 
all over the world :-)

m) Open Statistics/Endpoints and select the IPv4 tab

n) make sure you see some geolocation details (like City, Latitude, ...) 
already displayed here. It's ok, if not all rows show geo details, e.g. 
the 192.168... addresses are not locatable.

o) Click on the (now enabled) Map button

p) Your webbrowser should open now, displaying a map with markers for 
all known IPaddress locations

r) You can zoom/pan the map

s) You can click on each marker to get some more details


What happens behind the scenes ...
1) If you click the Map button, a file named ipmap.txt will be created 
in the temp folder. The ipmap.txt is basically a "tab seperated value" 
file containing the IP details needed for the map.

2) The file ipmap.html will be copied from the program(data?) to the 
temp folder.

3) Now Wireshark opens the webbrowser, loading the file ipmap.html

4) The javascript code in ipmap.html will load javascipt files from 
http://www.openlayers.org and http://www.openstreetmap.org and then show 
the openstreetmap graphics and the "ipmap.txt markers" layer above it.

5) ipmap.html and ipmap.txt will remain in the temp folder.



This is experimental, I would be interested if this also works on the 
unix part of the world ;-)

In case of any problems, the interesting code is in gtk/hostlist_table.c 
in the function open_as_map_cb(), starting at line 591.

Regards, ULFL