Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add new functions for calculating geographic distance

Browse source 
Added a new BIF haversine_distance that computes distance between two
geographic locations.

Added a new Bro script function haversine_distance_ip that does the same
but takes two IP addresses instead of latitude/longitude.  This function
requires that Bro be built with libgeoip.
This commit is contained in:
Daniel Thayer 2016-06-07 12:55:50 -05:00
parent 58dea28504
commit 91496543ad
5 changed files with 93 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/base/utils/geoip-distance.bro Normal file
View file

@ -0,0 +1,26 @@
##! Functions to calculate distance between two locations, based on GeoIP data.
## Returns the distance between two IP addresses using the haversine formula,
## based on GeoIP database locations. Requires Bro to be built with libgeoip.
##
## a1: First IP address.
##
## a2: Second IP address.
##
## Returns: The distance between *a1* and *a2* in miles, or -1.0 if GeoIP data
## is not available for either of the IP addresses.
##
## .. bro:see:: haversine_distance lookup_location
function haversine_distance_ip(a1: addr, a2: addr): double
{
local loc1 = lookup_location(a1);
local loc2 = lookup_location(a2);
local miles: double;
if (loc1?$latitude && loc1?$longitude && loc2?$latitude && loc2?$longitude)
miles = haversine_distance(loc1$latitude, loc1$longitude, loc2$latitude, loc2$longitude);
else
miles = -1.0;
return miles;
}