-
Notifications
You must be signed in to change notification settings - Fork 136
Description
As described in the geoip-conn README, the included GeoLite2 database is known to be less accurate than the paid GeoIP2 version. MaxMind's FAQ claims that their paid version should work as a "drop-in replacement".
In its current form, the geoip-conn package is effectively "hard-wired" to use just its included database, and Brim installs geoip-conn atop its embedded Zeek as-is. While a user could manually swap out the included database, when they later upgrade Brim, the configuration would effectively revert to using the free GeoLite2 database again.
One way for a user to avoid this would be if they were using Brim's customized Zeek option, such that pcap processing would always be done with a separate Zeek that the user has wired up with the paid database. However, for users that aren't using this approach, it might be useful if Brim provided a way to still use its embedded Zeek, but with a persistent pointer to a non-default database. This could perhaps be done at the level of the geoip-conn package itself, or perhaps with just a "preference" setting within Brim.