Enable GeoIP in Wireshark

Using the MaxMind databases, you can see IP addresses plotted on a world map.

Follow these steps to enable and use GeoIP.

Step 1: Download the following files from geolite.maxmind.com/download/geoip/database/. GeoLiteCity.dat.gz (in the GeoLite City directory)

GeoIP.dat.gz (in the GeoLite Country directory)

GeoIPASNum.dat.gz (in the asnum directory)

GeoLiteCityv6.dat.gz (in the GeoLite City directory)

GeoIPv6.dat.gz (in the GeoLite Country directory)

Step 2: Create a maxmind directory on your local drive and extract all the MaxMind files in that directory.

Step 3: In Wireshark, select Edit | Preferences | Name Resolution and click the Edit button in the GeoIP database directories area. Enter the path to your maxmind directory. You should restart Wireshark to take effect.

Step 4: Open http-espn2011.pcapng. Select Statistics | Endpoints and click on the IPv4 tab. (GeoIP mapping is available from the IPv4 tab in the Endpoints windows.) Click the Map button. An OpenStreetMap view of the world will appear with your IP addresses mapped with red flags. Click on a flag to learn more about that host.