You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
When a packet comes in, I want to know the GeoIP information about the original client, not their resolver.
Describe the solution you'd like
If a packet has an ECS subnet, use that for GeoIP lookups, otherwise use the source ip as it is now.
Describe alternatives you've considered
Record the GeoIP lookups for both ECS subnet and source ip?
Additional context
Using the ECS with a fallback of the source ip is what NSOne and PowerDNS use.
The text was updated successfully, but these errors were encountered:
The GoeIP transform could be updated to also perform ECS lookups.
My proposal is to add a new setting, lookup-ecs. When lookup-ecs is enabled and the packet contains an ECS subnet, the GeoIP lookup will use that subnet. Otherwise, it will default to using the source IP, as it currently does.
Sounds good, although if someone cares about geoip information, I can't foresee a situation where they'd want to look up the source ip's location instead of the ecs location. For completeness they might want to log both.
Is your feature request related to a problem? Please describe.
When a packet comes in, I want to know the GeoIP information about the original client, not their resolver.
Describe the solution you'd like
If a packet has an ECS subnet, use that for GeoIP lookups, otherwise use the source ip as it is now.
Describe alternatives you've considered
Record the GeoIP lookups for both ECS subnet and source ip?
Additional context
Using the ECS with a fallback of the source ip is what NSOne and PowerDNS use.
The text was updated successfully, but these errors were encountered: