Check your Public IP address Geo Location using the command line on Linux

If you are using VPN connections it can be important and useful to be able to check your current public IP. For me going to one of the many web sites that offer such a service is slow. As always on Linux the command line is the fastest way. Searching around I found geoiplookup which did exactly what I wanted. It uses the GeoIP library and database to find the Country that an IP address or hostname originates from.

Example

$ geoiplookup 80.60.233.195

Displays the country that 80.60.233.195 originates from e.g.

NL, Netherlands

You can have a simple bash script like :

#!/bin/bash
clear
echo "Current Public IP is :"
curl -s checkip.dyndns.org | sed 's/.*IP Address: \([0-9\.]*\).*/\1/g'
sleep 1
PUBLICIP=$(curl -s checkip.dyndns.org | sed 's/.*IP Address: \([0-9\.]*\).*/\1/g')
geoiplookup $PUBLICIP

To install on Arch :

$ sudo pacman -S geoip

To install on Ubuntu, Linux Mint or Debian

$ sudo apt-get install geoip-bin

By default the IP to country database is located at /usr/share/GeoIP/GeoIP.dat

Capture packets in Ascii and grep on traffic

There is so many different features to tcpdump for packet captures which can be used in many situations. Recently I wanted to capture traffic and grep on a certain string in the packet.

Installation

•  On Linux Mint or Ubuntu :

$ sudo apt-get -y install tcpdump

Example

• To capture all http web traffic (port 80) containing 'www.wikipedia.org'

$ sudo tcpdump -i eth0 -A -nn -vvv -s 0 port 80 | grep -e 'www.wikipedia.org'

• Either open a browser or use 'wget'

 $ wget http://www.wikipedia.org

•  The capture will show for example

 $ sudo tcpdump -i eth0 -A -nn -vvv -s 0 port 80 | grep -e 'www.wikipedia.org'
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
Host: www.wikipedia.org
<body id="www-wikipedia-org">
<form class="search-form" action="//www.wikipedia.org/search-redirect.php">

• It can be more useful to direct to a file :

  $ sudo tcpdump -i eth0 -A -nn -vvv -s 0 port 80 | grep -e 'www.wikipedia.org' > $HOME/tmp/wikipedia.tmp

•  Note on some Linux systems you may need to direct all ASCII traffic to a file as the redirect after the grep may not work

 $ sudo tcpdump -l -i eth0 -A -nn -vvv -s 0 port 80 > $HOME/tmp/wikipedia.tmp

•  To sort by uniq values and count the amount of occurrences in columns

$ grep "wikipedia.org" wikipedia.tmp | grep href | sort | uniq -c | sort -nr | head -n 2

1 <span lang="no">Norsk (<a href="//no.wikipedia.org/" lang="nb">bokm..l</a>&nbsp;... <a href="//nn.wikipedia.org/" lang="nn">nynorsk</a>)</span>&nbsp;...
1 ..&..O.. href="//chy.wikipedia.org/" lang="chy">Ts..hesen..stsestotse</a>&nbsp;...