This brief guide describes how to install and use geoiplookup utility to find the geolocation of an IP address in Linux and Unix-like operating systems.
A while ago, we wrote an article that described how to find out your geolocation from commandline using whereami utility. Today, we will see how to find the geolocation of an IP address. Of course, you can see this details from a web browser. But, it is lot easier to find it from commandline.
geoiplookup is a command line utility that can be used to find the Country that an IP address or hostname originates from. It uses the GeoIP library and database to collect the details of an IP address.
Install Geoiplookup in Linux
Geoiplookup is available in the default repositories of most Linux operating systems.
To install it on Arch Linux and its derivatives, run:
$ sudo pacman -S geoip
On Debian, Ubuntu, Linux Mint:
$ sudo apt-get install geoip-bin
On RHEL, CentOS, Fedora, Scientific Linux:
$ sudo yum install geoip
$ sudo zypper install geoip
Find The Geolocation Of An IP Address Using Geoiplookup From Commandline
Once installed, you can find out any IP address's geolocation like below.
$ geoiplookup 18.104.22.168
The above command will find and display the Country that 22.214.171.124 originates from, in the following format:
GeoIP Country Edition: NL, Netherlands
Download - Free eBook: "Computer Networking Concepts"
Download and update Geoip databases
Generally, the default location of Geoip databases is
/usr/share/GeoIP/. The databases might be bit outdated. You can download the latest databases that contains the updated geolocation details, from Maxmind. It is the website that offers the geolocation of an IP address.
Go to geoip default database folder:
$ cd /usr/share/GeoIP/
Download the latest databases:
$ wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
Now, run the geoiplookup command to find most up-to-date geolocation details of an IP address.
$ geoiplookup 126.96.36.199
GeoIP Country Edition: US, United States
As you see in the above output, it displays only the country location. Geoiplookup can even display more details such as the state, city, zip code, latitude and longitude etc. To do so, you need to download the city databases from Maxmind like below. Make sure you're downloading it in
$ wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
$ gunzip GeoLiteCity.dat.gz
Now, run the below command to get more details of an IP address's geolocation.
$ geoiplookup -f /usr/share/GeoIP/GeoLiteCity.dat 188.8.131.52
Sample output would be:
GeoIP City Edition, Rev 1: US, CA, California, Mountain View, 94043, 37.419201, -122.057404, 807, 650
If you have saved the database files in a custom location other than the default location, you can use '
-d' parameter to specify the path. Say for example, if you have saved the database files in
/home/sk/geoip/, the command to find the geolocation of an IP address would be:
$ geoiplookup -d /home/sk/geoip/ 184.108.40.206
For more details, see man pages.
$ man geoiplookup
The update database and city database commands get 404 errors…
Yeah this used to work. Now GeoIP is on version 2 and no longer uses .dat files. I don’t know how to fix it yet
MaxMind retired GeoLite in January 2019. https://support.maxmind.com/geolite-legacy-discontinuation-notice/
It’s time to adapt; so these tools might help:
– mmdblookup (MaxMind DB Lookup) – you can $ apt install mmdb-bin
– geoiplookup2 from axllent on GitHub
These are an okay place to start but you’ll still need to do some work (especially for mmdblookup). Enjoy!
Here is a versatile ip-geolocation tool written in c++ which works as a common line tool and as an
apache log file analyzer: https://github.com/softhub-software-development/gip
You have a typo in directory name, instead of ” /user/share/GeoIP/” it should read ” /usr/share/GeoIP/”