config.ini

[myConfig]
# to obtain interfaces, open cmd and type: tshark -D  (or ./tshark -D)
# if blank the first available interface will be selected as a default
# INTERFACE=

# font size
FONT_SIZE=8

# rule name has to be set to the corresponding language
# run cmd:
# >netsh advfirewall firewall show rule name=all
# check left-side before ----------------------------
RULE_NAME_STR=Rule name

# connection "established" has to be set to the corresponding language
# obtain the text by running cmd and typing:
# netstat -an
# check for "established" connections in column Status
# *** for other languages the text changes, set as it corresponds in your case ***
CONN_ESTABLISHED_STR=ESTABLISHED
# CONN_ESTABLISHED_STR=HERGESTELLT

# run as admin?
# to kill (some) processes or add rules to the Windows firewall..
# when running as Admin we get a CONSOLE
# though we have a very STRANGE BEHAVIOR...we start a complete new instance of the App
# we cannot debug when running as Admin..
RUN_AS_ADMIN=0

# add a new rule in Windows Firewall to block a BAD-IP automatically
# NOTE: if set to True, then RUN_AS_ADMIN shall also be set to True !!!
ADD_FIREWALL_RULE_BLOCK_BAD_IP=0

# shell to file?
SHELL_TO_FILE=1

# if option to ping a specified amount of random IPs is selected:
NR_OF_RANDOM_IPS_TO_PING=10

# check period in seconds
# to check, hosts resolutions, kill IPs and active connections
CHECK_PERIOD_IN_SEC=0.5

# packed visualization of output to terminal
PACKED_OUTPUT=0

# max TX bytes
MAX_TX_KILOBYTES=10000

# local router
# cmd> ipconfig (default gateway)
ROUTER_IP=192.168.178.1
# ROUTER_IP=192.168.178.1

# public IP
# can be found here:
# https://ifconfig.me/ip
# or here:
# https://www.whatismyip.com/
# if defined as empty then it will be determined during execution.
PUBLIC_IP=

# host locations
MY_CITY=Dallas
MY_COUNTRY=US
MY_IP_ADDRESS=ROUTER_IP # will be replaced by resolved "public" IP
MY_LATITUDE=32.8
MY_LONGITUDE=-96.9
MY_REGION=Texas

# map settings
# center in Dallas
MAP_CENTER_LAT=32.8
MAP_CENTER_LON=-96.9
MAP_INFO_LAT=30.0
MAP_INFO_LON=-50.0

# zoom enough to see the whole world in full-screen
MAP_ZOOM=3

# use white list or black list (exclusive alternatives!)
# if False then we'll use the Blacklist
USE_WHITE_LIST=1

# Black List
# see: https://dev.maxmind.com/geoip/legacy/codes/iso3166/
BlackList={
    "A1":"Anonymous Proxy", 
    "A2":"Satellite Provider", 
    "O1":"Other Country", 
    "AF":"Afghanistan",
    "SY":"Syrian Arab Republic"
    }

# EXCLUSIVE White List
# see: https://dev.maxmind.com/geoip/legacy/codes/iso3166/
WhiteList={
    "BE":"Belgium", 
    "CH":"Switzerland", 
    "DE":"Germany", 
    "GB":"United Kingdom", 
    "HK":"Hong Kong",
    "IE":"Ireland", 
    "IT":"Italy",
    "JP":"Japan",
    "NL":"Netherlands", 
    "NO":"Norway",
    "US":"United States"
    }

# EXCLUSIVE White List for NOT killing
# IMPORTANT: check which processes you need to add here
#                               if processes establish network connections they may be killed
#                               unless they are inside this list!
WhiteListNotKill=[
    "svchost.exe",
    "pythonw.exe",
    "python.exe",
    "thunderbird.exe",
    "whosip.exe",
    "MsMpEng.exe"
    ]

# Black List for BAD owner
# Rule: if BlackListOwner AND NOT WhiteListOwner
# WARNING: NOT IDENTIFIED owner names will be marked as BAD!
BlackListOwner=[
    "CEDIA",
    "Hostway LLC",
    "EDIS GmbH",
    "EDIS Infrastructure",
    "Hosting Services Inc. (dba Midphase)",
    "INTERNET-GROUP-DATACENTER"
    ]

# NON-EXCLUSIVE White List for BAD owner
# Rule: if BlackListOwner AND NOT WhiteListOwner
WhiteListOwner=[
    "Microsoft",
    "Google", 
    "Amazon",  
    "ARIN",
    "RiPE",
    "LACNIC",
    "APNIC",
    "AfriNIC",
    "Yahoo", 
    "Facebook", 
    "Mozilla",
    "Thunderbird",
    "Akamai",
    # "Avira",
    "Cloudflare"
    ]

# Black List for BAD city
BlackListCity=[
    "Montreal (Ville-Marie)",
    "Damascus"
    ]

# NON-EXCLUSIVE White List for good city
WhiteListCity=[
    "Centreville",
    "San Francisco",
    "Los Angeles"
    ]

[tshark]
# Specify the path to the tshark executable.
# If the configured path does not exist, these locations will be searched:
# (Linux): /usr/bin/tshark
# (Linux): /usr/sbin/tshark
# (Linux): /usr/lib/tshark/tshark
# (Linux): /usr/local/bin/tshark
# (Windows): %ProgramFiles%\Wireshark\tshark.exe
# (Windows): %ProgramFiles(x86)%\Wireshark\tshark.exe
# tshark_path = C:\Program Files\Wireshark\tshark.exe
tshark_path = dist\WiresharkPortable\App\Wireshark\tshark.exe

[dumpcap]
# dumpcap_path = C:\Program Files\Wireshark\dumpcap.exe
dumpcap_path = dist\WiresharkPortable\App\Wireshark\dumpcap.exe