HowTo Geolocate Network Packet Capture Data: Difference between revisions
| Line 8: | Line 8: | ||
* No '''IPv4 Addresses''' exist in the capture file. '''Results:''' No geolocations would be rendered. | * No '''IPv4 Addresses''' exist in the capture file. '''Results:''' No geolocations would be rendered. | ||
* All hosts in the capture file are located at the same physical location. '''Results:''' Geolocations would appear at a single point. | * All hosts in the capture file are located at the same physical location. '''Results:''' Geolocations would appear at a single point. | ||
* All hosts are private '''IP Addresses''' with no associated geolocation database information. '''Results:''' No geolocations would be rendered. '''Note:''' This can be corrected, see section: [[HowTo_Geolocate_Network_Packet_Capture_Data#IP_Geolocation_Adjustments | IP Geolocation Adjustments]]. | * All hosts are private '''IP Addresses''' with no associated geolocation database information. '''Results:''' No geolocations would be rendered. '''Note:''' This can be corrected, see section: [[HowTo_Geolocate_Network_Packet_Capture_Data#IP_Geolocation_Adjustments | IP Geolocation Database & Adjustments]]. | ||
| Line 16: | Line 16: | ||
[[Image:Single_packet_capture_decode.png|center|frame|Single-Tap Network Packet Capture Text-Based Decode Section]] | [[Image:Single_packet_capture_decode.png|center|frame|Single-Tap Network Packet Capture Text-Based Decode Section]] | ||
=== '''IP Geolocation Adjustments''' === | === '''IP Geolocation Database & Adjustments''' === | ||
Use the ''''[[HowTo_Setup_The_NST_System_To_Geolocate_Data | IP Geolocate Configure]]'''' button to manage the global geolocation policy for this NST system. This allows one to make latitude and longitude coordinate adjustments, configure private IPv4 Address/Network coordinate locations and select a Geolocation database source. In addition, one can also download and manage the '''[http://www.maxmind.com/ MaxMind]''' "'''GeoIP Country Edition'''", the enhanced "'''GeoIP Lite City Edition'''" and the "'''GeoIP AS Number Edition'''" data sets. | Use the ''''[[HowTo_Setup_The_NST_System_To_Geolocate_Data | IP Geolocate Configure]]'''' button to manage the global geolocation policy for this NST system. This allows one to make latitude and longitude coordinate adjustments, configure private IPv4 Address/Network coordinate locations and select a Geolocation database source. In addition, one can also download and manage the '''[http://www.maxmind.com/ MaxMind]''' "'''GeoIP Country Edition'''", the enhanced "'''GeoIP Lite City Edition'''" and the "'''GeoIP AS Number Edition'''" data sets. | ||
Revision as of 08:57, 11 October 2010
Overview
This HowTo explains the procedure for geolocating IPv4 Address Conversations using the NST WUI and rendering the results on either a Mercator World Map projection or on a KML Earth Browser such as Google Earth, Google Maps or Marble.
There are a couple of items to consider prior to starting IPv4 Address Conversations geolocation. First, does the network packet capture make sense to use for geolocation. The list below are packet capture characteristics that would not be considered desirable for geolocation:
- No IPv4 Addresses exist in the capture file. Results: No geolocations would be rendered.
- All hosts in the capture file are located at the same physical location. Results: Geolocations would appear at a single point.
- All hosts are private IP Addresses with no associated geolocation database information. Results: No geolocations would be rendered. Note: This can be corrected, see section: IP Geolocation Database & Adjustments.
IP Geolocation Database & Adjustments
Use the ' IP Geolocate Configure' button to manage the global geolocation policy for this NST system. This allows one to make latitude and longitude coordinate adjustments, configure private IPv4 Address/Network coordinate locations and select a Geolocation database source. In addition, one can also download and manage the MaxMind "GeoIP Country Edition", the enhanced "GeoIP Lite City Edition" and the "GeoIP AS Number Edition" data sets.
