NirSoft’s CurrPorts, NetworkTrafficView gain IP geolocation support
In practical terms that means the programs now include a “Remote IP Country” column in their report tables, and in some cases this will list the country (and, occasionally, the city) for that IP address.
There is just a little configuration work required before this will happen, though. Specifically, you must go to MaxMind’s GeoLite web page, download the gzipped version of the city database (called “GeoLite City”, file name currently GeoLiteCity.dat.gz) and save it to the same folder as your NirSoft executables.
And with that done, restart your NirSoft tools, open several browser windows and navigate to a few big sites, and you should find the “Remote IP Country” column now contains relevant location information for at least one or two of your open connections. (Not necessarily all – this is a free database, and not exhaustive – but it was good enough to deliver plenty of useful results in our initial tests.)
If you’re going to try this, then keep in mind that the GeoLite databases are updated on the first Tuesday of every month (the download page will give you more information). You’ll probably want to download new versions on a regular basis to ensure that your reports are as accurate as possible.