Funnelback IP Intelligence

gavin1211 2019-10-23 11:14:06 UTC #1

How does Funnelback do IP location sniffing? Does it use Maxmind database and is this updated regularly?

We are finding a lot of client IP's either come back as the wrong country, or as NULL. However Funnelback picks up the IP ok, which is displayed within "requestId" in the data model JSON.

plevan 2020-01-16 22:21:18 UTC #2

Funnelback does use a maxmind database to do IP lookups.

The database used was updated to the v2 database in 15.24 but hadn't been updated within Funnelback for quite some time. If you're running a version older than 15.24 it's possible to update the database used to a more recent on (whatever the latest v1 database is) but that is still a bit out of date since Maxmind don't update that database anymore.

plevan 2020-01-17 02:13:37 UTC #3

For 15.22 and earlier if you wish to update the Maxmind database you can do the following:

Note: make sure you backup existing files before you make any changes.

Grab the last GeoLiteCity.dat file from here: https://mirrors-cdn.liferay.com/geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.xz
Copy it it into $SEARCH_HOME/share

Note: the last update was 27th March 2018, so it's a bit out of date. The v1 database is no longer maintained and that's the latest version available. The only way to get a more current database is to upgrade Funnelback to 15.24 or later.