The GeoIP Kernel design is show in the figure below:
The functions of each module in the figure are:
- findAddrID: find start address in netLow21 according to input ip
- readHead and findChunck: Narrow the search scope in netLow21
- addrConvert, readNetLow21 and searchID: Find the netLow21 corresponding to ip and get its id.