Some alerts do not show either Source Geolocation or Destination Geolocation

Help
1

Hi.

I noticed that some alerts do not show either Destination geolocation or Source geolocation information. Sometimes misses country information and sometimes misses city information even both at the same time.

Is this normal behaviour?

2

What version are you running with what config and what GeoIP DB?
Most obvious scenario would be, that the GeoIP DB misses that information.

3

I am using the latest Suricata version with GeoLite2 Country database

4

How does the config look like?
Can you provide examples and did you compare the IPs with the DB itself?

5

This is normal, specifically on private ip ranges.