Using IP2Location MMDB with TShark for IP Geolocation

Intro #

IP2Location MMDB with TShark makes it possible to enrich network packet analysis with IP geolocation and ASN information directly from the command line.

TShark is the command-line version of Wireshark. It provides many of the same packet capture, protocol analysis, and filtering capabilities as Wireshark, without requiring a graphical user interface.

This makes TShark particularly useful on Linux servers, cloud instances and other headless environments where administrators need to inspect network traffic directly from a terminal.

One useful feature available in TShark is IP geolocation. When a packet contains a public IPv4 or IPv6 address, TShark can look up information about that address from locally installed MMDB databases and make fields such as country, city, latitude, longitude, Autonomous System Number (ASN) and AS organization available during packet analysis.

IP2Location provides its IP geolocation and ASN data in MMDB format. This means the IP2Location LITE DB11 and IP2Location LITE ASN MMDB databases can be used to enrich network packets analyzed by TShark.

In this tutorial, we will install TShark on a Debian 13 server, configure the IP2Location MMDB databases, capture network traffic and demonstrate how to:

• Look up an IP address directly using mmdbresolve
• Capture network packets using TShark
• Analyze an existing PCAP or PCAPNG file
• Display country, city, latitude, longitude, ASN and AS organization
• Filter packets by country, city and ASN
• Export geolocation-enriched packet information to CSV

No programming or custom application code is required.

Install TShark on Debian 13 #

First, update the package information:

sudo apt update

Install TShark together with a few utilities that will be useful during this tutorial:

sudo apt install tshark unzip curl iputils-ping

You do not need to install the graphical Wireshark application.

The Debian tshark package automatically installs the required Wireshark libraries and wireshark-common package. The latter also provides tools such as mmdbresolve.

During installation, Debian may display the following question:

Should non-superusers be able to capture packets?

For this tutorial, you can select:

No

This keeps Debian’s default security model. We will use sudo when capturing packets.

After installation has completed, verify TShark:

tshark --version

The exact version may be newer depending on when you follow this tutorial.

You can also check whether the installed TShark build includes MaxMind DB support:

tshark --version | grep -i maxmind

You should see MaxMind mentioned in the TShark build information.

Finally, verify that mmdbresolve is available:

which mmdbresolve

The result should normally be:

/usr/bin/mmdbresolve

What is mmdbresolve? #

mmdbresolve is a command-line utility included with Wireshark. It reads IPv4 or IPv6 addresses from standard input and looks them up using one or more MMDB databases.

We will use it before TShark to verify that our IP2Location MMDB files can be opened and queried successfully.

This is useful for troubleshooting because it separates MMDB database configuration from packet capture.

Download the IP2Location LITE DB11 and ASN MMDB databases #

For this tutorial, we will use two free IP2Location LITE databases:

IP2Location LITE DB11 #

Provides geolocation information including:

Country

Region

City

Latitude

Longitude

ZIP code

Time zone

IP2Location LITE ASN #

Provides:

Autonomous System Number

Autonomous System name/organization

Sign up and get your download token #

Sign up for a free IP2Location account if you don’t have one and visit the IP2Location LITE database download section. Retrieve your download token as we will use that to download the IP2Location LITE DB11 and IP2Location LITE ASN programmatically.

For the two LITE MMDB databases, use the following MMDB download codes:

DB11LITEMMDB

DBASNLITEMMDB

Download the zipped files using the download token #

Create the folder where we’ll save the downloads to:

mkdir -p ~/ip2location-mmdb
cd ~/ip2location-mmdb

IP2Location’s current downloader uses the below format:

https://www.ip2location.com/download?token=YOUR_DOWNLOAD_TOKEN&file=DATABASE_CODE

Run the below codes to download the 2 files after modifying it for your download token from above:

TOKEN="YOUR_DOWNLOAD_TOKEN"

curl -L \

  -o IP2LOCATION-LITE-DB11.zip \

  "https://www.ip2location.com/download?token=${TOKEN}&file=DB11LITEMMDB"

curl -L \

  -o IP2LOCATION-LITE-ASN.zip \

  "https://www.ip2location.com/download?token=${TOKEN}&file=DBASNLITEMMDB"

The -L is important because IP2Location’s download endpoint redirects to the actual download host which is the Cloudflare R2.

Extract the required MMDB files #

Run the below to extract only the MMDB files that we need from the zipped files:

unzip IP2LOCATION-LITE-DB11.zip IP2LOCATION-LITE-DB11.MMDB
unzip IP2LOCATION-LITE-ASN.zip IP2LOCATION-LITE-ASN.MMDB

Configure the MMDB files for TShark #

Wireshark and TShark automatically search several standard directories for MMDB databases on Linux, including:

/usr/share/GeoIP

/var/lib/GeoIP

We will use:

/usr/share/GeoIP

Create the directory if it does not already exist:

sudo mkdir -p /usr/share/GeoIP

Move the DB11 database while changing its extension to lowercase:

sudo mv IP2LOCATION-LITE-DB11.MMDB /usr/share/GeoIP/IP2LOCATION-LITE-DB11.mmdb

Do the same for the ASN database:

sudo mv IP2LOCATION-LITE-ASN.MMDB /usr/share/GeoIP/IP2LOCATION-LITE-ASN.mmdb

The resulting directory should contain:

/usr/share/GeoIP/IP2LOCATION-LITE-DB11.mmdb

/usr/share/GeoIP/IP2LOCATION-LITE-ASN.mmdb

Check them:

ls -lh /usr/share/GeoIP/

You should see both MMDB files.

The lowercase .mmdb extension is important because Wireshark’s automatic database loading searches for files ending in .mmdb.

The database filenames themselves can be anything. TShark identifies MMDB files by their format and supported internal fields, rather than requiring a specific filename.

Test IP2Location MMDB using mmdbresolve #

Before analyzing packet captures, we can test the databases directly.

Let’s look up Google’s public DNS address:

echo 8.8.8.8 | mmdbresolve \
  -f /usr/share/GeoIP/IP2LOCATION-LITE-DB11.mmdb \
  -f /usr/share/GeoIP/IP2LOCATION-LITE-ASN.mmdb

The beginning of the output should contain an initialization section similar to:

[init]
db.0.path: /usr/share/GeoIP/IP2LOCATION-LITE-DB11.mmdb
db.0.status: OK
db.1.path: /usr/share/GeoIP/IP2LOCATION-LITE-ASN.mmdb
db.1.status: OK
mmdbresolve.status: true

This is important.

The following:

db.0.status: OK
db.1.status: OK
mmdbresolve.status: true

confirms that mmdbresolve was able to open the databases.

Below that, information associated with 8.8.8.8 should be displayed.

Depending on the current database data, you may see fields such as:

country.iso_code

country.names.en

city.names.en

location.latitude

location.longitude

autonomous_system_number

autonomous_system_organization

The exact geographic values may change as IP address assignments and geolocation data are updated.

Check which GeoIP fields TShark supports #

TShark exposes geolocation information through Wireshark display fields.

To see the available fields:

tshark -G fields | grep -i geoip

Among the IPv4 fields, you should find fields such as:

ip.geoip.src_country

ip.geoip.src_country_iso

ip.geoip.src_city

ip.geoip.src_lat

ip.geoip.src_lon

ip.geoip.src_asnum

ip.geoip.src_org

ip.geoip.dst_country

ip.geoip.dst_country_iso

ip.geoip.dst_city

ip.geoip.dst_lat

ip.geoip.dst_lon

ip.geoip.dst_asnum

ip.geoip.dst_org

IPv6 has corresponding fields beginning with:

ipv6.geoip

For example:

ipv6.geoip.src_country

ipv6.geoip.src_city

ipv6.geoip.src_asnum

ipv6.geoip.dst_country

It is worth noting that IP2Location DB11 contains additional information such as region, ZIP code and time zone. Stock TShark exposes only the MMDB properties for which Wireshark has corresponding GeoIP fields.

List the available network interfaces #

Before capturing traffic, identify the network interface used by the Debian server.

Run:

tshark -D

Example output could look similar to:

Your server may use interface names such as:

ens5

enp1s0

eth0

For the rest of this tutorial, we will use our interface name:

ens5

Replace ens5 with the actual interface shown on your server.

Capture network traffic using TShark #

Our SSH is on port 22 which may clutter up the traffic hence we’ll filter out port 22 from our capture.

We can start a basic live capture with:

sudo tshark \
  -i ens5 \
  -f "not tcp port 22"

TShark will immediately begin displaying packets.

Press:

Ctrl+C

to stop the capture.

Capture a limited number of packets #

For a tutorial, limiting the number of packets makes the output easier to manage.

For example:

sudo tshark \
  -i ens5 \
  -c 100 \
  -f "not tcp port 22"

The command stops automatically after 100 packets have been captured.

Capture traffic with IP geolocation enabled #

TShark uses the -N option to control name-resolution features.

The flag:

g

enables IP geolocation lookup using the configured MMDB databases.

Therefore, a live capture with IP geolocation enabled can be started using:

sudo tshark \
  -i ens5 \
  -f "not tcp port 22" \
  -N g \
  -T fields \
  -E header=y \
  -e ip.src \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.dst \
  -e ip.geoip.dst_country \
  -e ip.geoip.dst_city

Or limit it to 100 packets:

sudo tshark \
  -i ens5 \
  -f "not tcp port 22" \
  -N g \
  -c 100 \
  -T fields \
  -E header=y \
  -e ip.src \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.dst \
  -e ip.geoip.dst_country \
  -e ip.geoip.dst_city

However, for production servers or busy network interfaces, it is generally better to capture traffic first and perform MMDB geolocation analysis afterward.

TShark performs geolocation lookups synchronously during a live capture. On a very busy interface, additional processing could make packet capture more difficult to keep up with.

For that reason, the following capture-and-analyze workflow is preferable for this tutorial.

Save network traffic to a PCAPNG file #

Capture 200 packets and save them to a file:

sudo tshark -i ens5 \
  -f "not tcp port 22" \
  -c 200 \
  -w /tmp/capture.pcapng

TShark’s normal capture format is PCAPNG.

After the capture finishes, verify that the file exists:

ls -lh /tmp/capture.pcapng

You can also inspect information about the capture:

sudo capinfos /tmp/capture.pcapng

Generate some test traffic #

If the server is relatively idle, you can intentionally generate some public Internet traffic while the capture is running. Easiest way to generate traffic from multiple IP addresses, just go to https://globalping.io/ and paste your server IP address into the test section and ping it from whichever regions you want to test.

Read the capture using TShark #

A saved packet capture can be analyzed with:

sudo tshark -r /tmp/capture.pcapng

The -r option tells TShark to read packets from the specified capture file rather than from a live network interface.

To enable MMDB geolocation while reading the file, add:

-N g

The complete command becomes:

sudo tshark -r /tmp/capture.pcapng -N g

This is the basic command we will build upon in the following examples.

Display source IP geolocation #

Instead of displaying every packet field, TShark can output only the fields we are interested in.

Run:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ip" \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city

The output will contain:

Source IP

Country code

Country

City

For packets containing private addresses such as:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

geolocation information may be empty because these are private network addresses rather than publicly routable Internet addresses.

Display latitude and longitude #

We can add geographic coordinates:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ip" \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.geoip.src_lat \
  -e ip.geoip.src_lon

This provides a convenient terminal view containing:

IP address

Country

City

Latitude

Longitude

Display ASN information #

Because we also installed the IP2Location LITE ASN MMDB database, TShark can provide Autonomous System information.

Run:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ip" \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_asnum \
  -e ip.geoip.src_org

The output will include the ASN and Autonomous System organization associated with the public source IP address where data is available.

For example, an address belonging to Google may show an ASN associated with Google, while an address belonging to another ISP or cloud provider will show the corresponding network organization.

Display both source and destination geolocation #

For network analysis, it is often more useful to examine both ends of the connection.

Run:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ip" \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.geoip.src_asnum \
  -e ip.geoip.src_org \
  -e ip.dst \
  -e ip.geoip.dst_country_iso \
  -e ip.geoip.dst_country \
  -e ip.geoip.dst_city \
  -e ip.geoip.dst_asnum \
  -e ip.geoip.dst_org

This allows you to see information similar to:

Source IP

Source country

Source city

Source ASN

Source organization

Destination IP

Destination country

Destination city

Destination ASN

Destination organization

This is the command-line equivalent of enriching the IP endpoints displayed in Wireshark.

Filter traffic by country #

One advantage of MMDB integration is that the geolocation fields can also be used in TShark display filters.

For example, to display packets whose source IP geolocates to Germany:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y 'ip.geoip.src_country_iso == "DE"' \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city

You can change the two-letter ISO country code to whichever country you wish to investigate.

Filter traffic by city #

Suppose the captured traffic contains a public IP address geolocated to Amsterdam.

You can display only packets originating from that city with:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y 'ip.geoip.src_city == "Amsterdam"' \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city

This provides a command-line equivalent to applying a city-based GeoIP display filter in Wireshark.

Filter traffic by ASN #

TShark can also use ASN information as part of a display filter.

For example:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y 'ip.geoip.src_asnum == 14061' \
  -T fields \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.geoip.src_asnum \
  -e ip.geoip.src_org

This would display source traffic matching ASN 14061 where that ASN is present in the capture and database.

Filter destination traffic instead #

All of the previous filters can also be applied to destination IP addresses.

Country:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y 'ip.geoip.dst_country_iso == "DE"'

City:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y 'ip.geoip.dst_city == "Amsterdam"'

ASN:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y 'ip.geoip.dst_asnum == 14061'

This makes it possible to investigate either traffic entering the server or connections made by the server to external networks.

Export geolocation-enriched packet data to CSV #

TShark can output selected packet fields in CSV-compatible format without writing any additional program.

Run:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ip" \
  -T fields \
  -E header=y \
  -E separator=, \
  -E quote=d \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.geoip.src_asnum \
  -e ip.geoip.src_org \
  -e ip.dst \
  -e ip.geoip.dst_country_iso \
  -e ip.geoip.dst_country \
  -e ip.geoip.dst_city \
  -e ip.geoip.dst_asnum \
  -e ip.geoip.dst_org

The options:

-T fields

tell TShark to output selected fields.

-E header=y

adds column headers.

-E separator=,

uses commas between columns.

-E quote=d

places double quotation marks around values where appropriate.

To save the output to a file:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ip" \
  -T fields \
  -E header=y \
  -E separator=, \
  -E quote=d \
  -e ip.src \
  -e ip.geoip.src_country_iso \
  -e ip.geoip.src_country \
  -e ip.geoip.src_city \
  -e ip.geoip.src_asnum \
  -e ip.geoip.src_org \
  -e ip.dst \
  -e ip.geoip.dst_country_iso \
  -e ip.geoip.dst_country \
  -e ip.geoip.dst_city \
  -e ip.geoip.dst_asnum \
  -e ip.geoip.dst_org \
  > geolocation.csv

Verify the file:

ls -lh geolocation.csv

View the first few lines:

head geolocation.csv

The resulting CSV can be imported into spreadsheet software, log-analysis tools, SIEM platforms or other systems for further analysis.

Analyze an existing PCAP file #

TShark does not require packets to have been captured on the same machine.

If you already have a PCAP or PCAPNG file from another server, network appliance or troubleshooting session, simply transfer it to the Debian server.

The MMDB lookup happens when TShark analyzes the packet, so the original PCAP file does not need to contain geolocation information.

This makes the setup particularly useful for network forensics and offline traffic investigation.

IPv6 geolocation #

IP2Location MMDB can also be used with IPv6 traffic when the database contains the appropriate IPv6 records.

The equivalent TShark fields use the ipv6.geoip prefix.

For example:

sudo tshark -r /tmp/capture.pcapng -N g \
  -Y "ipv6" \
  -T fields \
  -e ipv6.src \
  -e ipv6.geoip.src_country_iso \
  -e ipv6.geoip.src_country \
  -e ipv6.geoip.src_city \
  -e ipv6.geoip.src_asnum \
  -e ipv6.geoip.src_org \
  -e ipv6.dst \
  -e ipv6.geoip.dst_country_iso \
  -e ipv6.geoip.dst_country \
  -e ipv6.geoip.dst_city \
  -e ipv6.geoip.dst_asnum \
  -e ipv6.geoip.dst_org

This allows the same workflow to be used for both IPv4 and IPv6 packet analysis.

Troubleshooting: no geolocation information appears #

If TShark displays IP addresses but the GeoIP fields are empty, check the following.

First, verify that both databases exist:

ls -lh /usr/share/GeoIP/

The filenames should end in lowercase:

.mmdb

Next, test them directly:

echo 8.8.8.8 | mmdbresolve \
  -f /usr/share/GeoIP/IP2LOCATION-LITE-DB11.mmdb \
  -f /usr/share/GeoIP/IP2LOCATION-LITE-ASN.mmdb

Look for:

db.0.status: OK

db.1.status: OK

mmdbresolve.status: true

Next, make sure geolocation lookup is explicitly enabled:

sudo tshark -r /tmp/capture.pcapng -N g

You can also verify that the installed version supports the GeoIP fields:

tshark -G fields | grep -i geoip

Finally, remember that private and reserved addresses will not normally have public Internet geolocation information.

Examples include:

127.0.0.1

10.x.x.x

172.16.x.x – 172.31.x.x

192.168.x.x

If your capture contains mostly private addresses, inspect the public source or destination addresses instead.

Troubleshooting: permission denied when capturing #

If this command:

tshark -i ens5

returns a permission error, this is expected when non-root packet capture has not been enabled.

Use:

sudo tshark -i ens5

Why use IP2Location MMDB with TShark? #

Using IP2Location MMDB directly inside TShark has several advantages on Linux servers.

The database lookup happens locally, so packet IP addresses do not need to be sent to an external geolocation API.

There is also no API request required for every IP address encountered in a capture.

Once the database has been installed locally, the same MMDB data can be used repeatedly for live captures and existing packet files.

Because TShark is command-line based, the results can also be combined with standard Linux tools and incorporated into server administration, network troubleshooting, incident investigation and security analysis workflows.

For example, an administrator could use TShark to quickly investigate questions such as:

Which countries are communicating with this server?

Which public IP addresses belong to a particular ASN?

Where are outbound connections being sent?

Does a packet capture contain traffic from an unexpected country?

Which network organizations appear in a captured incident?

And because TShark can export fields directly to CSV, the enriched traffic information can easily be passed to other analysis tools.

TShark versus Wireshark for IP geolocation #

Both applications use the same underlying Wireshark packet-analysis framework, but they target different environments.

Wireshark provides a graphical interface that is convenient for interactive packet inspection, endpoint views and visual analysis.

TShark provides the same general packet-dissection capabilities from a terminal, making it especially useful on:

Headless Linux servers

Cloud virtual machines

Remote systems accessed over SSH

Automated network-analysis environments

Systems without a desktop GUI

For network administrators who already work primarily through SSH, TShark provides a convenient way to combine packet analysis with IP2Location geolocation without installing a graphical desktop environment.

A note about IP geolocation accuracy #

IP geolocation should not be interpreted as GPS positioning or the exact physical location of an individual device.

IP2Location estimates geographic and network information associated with an IP address based on the Internet network to which that address belongs.

Country-level information is generally more suitable for broad traffic analysis, while city and coordinate information should be treated as an estimate.

For network troubleshooting and security analysis, geolocation is therefore best used as additional network intelligence alongside packet details, ASN information, DNS information, logs and other evidence.

Conclusion #

TShark makes it possible to bring IP geolocation directly into command-line packet analysis on a Debian server.

In this tutorial, we installed TShark on Debian 13, added the IP2Location LITE DB11 and ASN MMDB databases, verified them using mmdbresolve, captured network packets and enriched the resulting traffic with geographic and Autonomous System information.

Once configured, commands such as:

sudo tshark -r /tmp/capture.pcapng -N g

allow TShark to perform local MMDB geolocation while analyzing a packet capture.

Combined with TShark’s field extraction and display filtering capabilities, IP2Location MMDB can help network administrators, security teams and developers identify the country, city, geographic coordinates, ASN and network organization associated with public IP addresses seen in network traffic.

No custom programming and no external IP geolocation API calls are required.

Disclaimer #

MaxMind and GeoIP are registered trademarks of MaxMind, Inc. Wireshark and the Wireshark logo are registered trademarks of the Wireshark Foundation.