{"id":13587045,"url":"https://github.com/erichutchins/geoipsed","last_synced_at":"2026-03-08T05:02:06.533Z","repository":{"id":74610566,"uuid":"504359237","full_name":"erichutchins/geoipsed","owner":"erichutchins","description":"Fast, inline geolocation decoration of IPv4 and IPv6 addresses written in Rust","archived":false,"fork":false,"pushed_at":"2026-03-02T13:31:25.000Z","size":254,"stargazers_count":29,"open_issues_count":1,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-03-02T16:17:26.517Z","etag":null,"topics":["cli","dfir","geoip"],"latest_commit_sha":null,"homepage":"https://erichutchins.github.io/geoipsed/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/erichutchins.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-06-17T01:43:01.000Z","updated_at":"2026-03-02T13:31:29.000Z","dependencies_parsed_at":"2024-02-13T21:53:04.244Z","dependency_job_id":null,"html_url":"https://github.com/erichutchins/geoipsed","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/erichutchins/geoipsed","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/erichutchins%2Fgeoipsed","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/erichutchins%2Fgeoipsed/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/erichutchins%2Fgeoipsed/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/erichutchins%2Fgeoipsed/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/erichutchins","download_url":"https://codeload.github.com/erichutchins/geoipsed/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/erichutchins%2Fgeoipsed/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30243778,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-08T00:58:18.660Z","status":"online","status_checked_at":"2026-03-08T02:00:06.215Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","dfir","geoip"],"created_at":"2024-08-01T15:05:59.204Z","updated_at":"2026-03-08T05:02:06.526Z","avatar_url":"https://github.com/erichutchins.png","language":"Rust","funding_links":[],"categories":["Rust"],"sub_categories":[],"readme":"# geoipsed\n\n_Fast, inline geolocation decoration of IPv4 and IPv6 addresses written in Rust_\n\nIP geolocation enriches logs with City, Country, ASN, and timezone metadata. `geoipsed` finds and decorates IP addresses in-place, leaving existing context intact—perfect for incident response and network analysis.\n\n## Quick Start\n\n```bash\ncargo install geoipsed\necho \"Connection from 81.2.69.205 to 175.16.199.37\" | geoipsed\n```\n\nOutput:\n\n```\nConnection from \u003c81.2.69.205|AS0_|GB|London\u003e to \u003c175.16.199.37|AS0_|CN|Changchun\u003e\n```\n\n## Features\n\n- IPv4 and IPv6 support with strict validation\n- City, Country, ASN, timezone metadata\n- Flexible templating via `-t/--template`\n- Inline decoration or JSON output modes (`--tag`, `--tag-files`)\n- Fine-grained filtering: `--all`, `--no-private`, `--no-loopback`, `--no-broadcast`\n- Color support with `-C/--color`\n- Streaming input (stdin or multiple files)\n- ~100x faster than Python implementations\n\n## Databases\n\nSupports MaxMind (default), IP2Location, and IPinfo MMDB formats. Specify location with `-I` or `GEOIP_MMDB_DIR` environment variable.\n\n## Usage\n\n```\ngeoipsed --help\nInline decoration of IPv4 and IPv6 address geolocations\n\nUsage: geoipsed [OPTIONS] [FILE]...\n\nArguments:\n  [FILE]...  Input file(s) to process. Leave empty or use \"-\" to read from stdin\n\nOptions:\n  -o, --only-matching        Show only nonempty parts of lines that match\n  -C, --color \u003cCOLOR\u003e        Use markers to highlight the matching strings [default: auto] [possible values: always, never, auto]\n  -t, --template \u003cTEMPLATE\u003e  Specify the format of the IP address decoration. Use the --list-templates option to see which fields are available. Field names are enclosed in {}, for example \"{field1} any fixed string {field2} \u0026 {field3}\"\n      --tag                  Output matches as JSON with tag information for each line\n      --tag-files            Output matches as JSON with tag information for entire files\n      --all                  Include all types of IP addresses in matches\n      --no-private           Exclude private IP addresses from matches\n      --no-loopback          Exclude loopback IP addresses from matches\n      --no-broadcast         Exclude broadcast/link-local IP addresses from matches\n      --only-routable        Only include internet-routable IP addresses (requires valid ASN entry)\n      --provider \u003cPROVIDER\u003e  Specify the MMDB provider to use (default: maxmind) [default: maxmind]\n  -I \u003cDIR\u003e                   Specify directory containing the MMDB database files [env: GEOIP_MMDB_DIR=]\n      --list-providers       List available MMDB providers and their required files\n  -L, --list-templates       Display a list of available template substitution parameters to use in --template format string\n  -h, --help                 Print help\n  -V, --version              Print version\n```\n\n## Examples\n\n```bash\n# Decoration mode\ngeoipsed access.log\n\n# Only matching IPs (with decoration)\ngeoipsed -o access.log\n\n# Custom template\ngeoipsed -t \"{ip} in {country_iso}\" access.log\n\n# Filter: public IPs only\ngeoipsed --no-private --no-loopback --no-broadcast access.log\n\n# Advanced: JSON output of matching ranges with before and after decoration\ngeoipsed --tag access.log\n```\n\n### Extracting just IPs\n\nFor scenarios where you only need a raw list of IP addresses (like `grep -o` but faster and with IP validation), use the standalone `justips` tool:\n\n```bash\ncargo install justips\njustips access.log\n```\n\n`justips` is a specialized, zero-dependency version of the extraction engine that is ~45% faster than `ripgrep` for finding IPs.\n\n## Performance\n\n`geoipsed` is highly optimized for sequential IP extraction, even outperforming `ripgrep` itself for this specific task.\n\nBenchmarked against a **1.7GB Suricata log** (15.4M lines, 30.7M IP matches):\n\n| Tool | Mode | Time | Throughput | Speedup |\n| :--- | :--- | :---: | :---: | :---: |\n| **`justips`** | **Parallel mmap + DFA** | **857ms** | **~2 GiB/s** | **7.2x** |\n| `ripgrep` | `rg -ao` (v4/v6 regex) | 6.17s | ~275 MiB/s | Baseline |\n| Python (`re`) | `IPRE.sub()` (baseline) | 431s | ~4 MiB/s | 0.01x |\n\nFor raw IP extraction (no geolocation), use the standalone [`justips`](crates/justips/) tool — it uses parallel mmap processing and is purpose-built for maximum throughput.\n\n**Why is the DFA so fast?** While `ripgrep` is a world-class general search tool, `geoipsed` and `justips` use a specialized, compile-time DFA generated via `regex-automata`. This allows parsing and validating every `IpAddr` during the scan faster than a general regex engine can match the raw text.\n\n## Workspace Crates\n\n| Crate | Description |\n| :--- | :--- |\n| [`ip-extract`](crates/ip-extract/) | Zero-copy IP extraction library — compile-time DFA, defang support, builder pattern |\n| [`justips`](crates/justips/) | Standalone CLI for fast IP extraction — parallel mmap, built-in dedup (`-u`, `-U`) |\n| [`ipextract`](crates/ipextract-py/) | Python bindings (PyO3 + maturin) — stable ABI, published to [PyPI](https://pypi.org/project/ipextract/) |\n\n## Documentation\n\nFull documentation, architecture details, and benchmarks available at [GitHub Pages](https://erichutchins.github.io/geoipsed/).\n\n## Contributing\n\nSee [CLAUDE.md](CLAUDE.md) for project conventions and coding patterns.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ferichutchins%2Fgeoipsed","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ferichutchins%2Fgeoipsed","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ferichutchins%2Fgeoipsed/lists"}