inliniac/suricata — pull request #145 by owlsec (2012-10-18 20:51:46+00:00)
Title: Geoip

geoip keyword support for ipv4 country geolocation.

Syntax: +

Match-on: src, dst, both or any. If no match-on condition is specified, it defaults to any. ie: geoip:FR;

Condition:
* Multiple countries supported in the same rule. ie: geoip:src,US,DE,CA,FR;
* Negation ! is supported. If one country is negated, all the other countries in the same rule are as well.