dotse/PacketQ — pull request #14 by arjenz (2013-11-26 09:21:53+00:00)
Title: Add aslookup feature

Optional lookup ASLOOKUP to look up an AS (Autonomous System) number.
Compiling with --with-GeoIP adds 2 command line parameters and 1 extra
SQL keyword.

- Usage
packetq -c -s "SELECT COUNT(*) as count, ASLOOKUP(src_addr) AS asnumber FROM dns WHERE qr=0 GROUP BY asnumber ORDER BY COUNT DESC LIMIT 10" -g GeoIPASNum.dat -G GeoIPASNumv6.dat dns.pcap
This generates the top 10 of querying networks.

- Extra dependencies
libgeoip C API (https://github.com/maxmind/geoip-api-c)
AS lookup databases can be downloaded from http://dev.maxmind.com/geoip/legacy/geolite/

Tested on Ubuntu 12.04 and 12.10