[Bro] No future updates to GeoIP legacy databases

[Jim Mellander]

For those using Bro with libgeoip for IP location data, such as country of
origin, Maxmind has announced that March 2018 will be the last update to
the free legacy database:

https://dev.maxmind.com/geoip/geoip2/geolite2/
https://blog.hqcodeshop.fi/archives/387-MaxMind-GeoIP-database-legacy-version-discontinued.html

Some options appear to be:

   1. Update Bro to use the new Maxmind library.
   2. In the short term, generate legacy databases from the distributed
   CSVs for the new format from
   https://dev.maxmind.com/geoip/geoip2/geolite2/ using code like
   https://github.com/mteodoro/mmutils or
   https://github.com/dankamongmen/sprezzos-world/blob/master/packaging/geoip/debian/src/geoip-csv-to-dat.cpp
   (these would need to be modified to create legacy databases from the new
   format CSVs)....
   3. Hope someone does #2 above and provides access to those generated
   databases.
   4. Become a paying customer of Maxmind to continue to access the legacy
   format databases
   5. Switch to another vendor with free IP location data, such as
   https://lite.ip2location.com/ - requiring a different library to access
   6. Do nothing, in which case convergence from reality will gradually
   emerge.

I would be interested in the group's thoughts about this.


Jim Mellander, ESNet
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180412/922888b0/attachment.html