🚀 go-pugleaf

Lois Patterson (lois@infomatch.com) wrote:
: How do you resolve an IP address to determine the ISP or company that it
: belongs to?
: For example, Westel owns at least some of the (I hope that's the right word) 
: 204.244.x.x addresses.
Here are the tools: "nslookup" and "traceroute".
Under Unix, it might be in your path. If not, the most likely place for them 
are /usr/sbin, /sbin and /etc.

Here's an example of nslookup:
I type	% nslookup
	Default Server:  espresso.cafe.net
	Address:  204.244.119.1

I type	> 204.244.0.0
	Server:  espresso.cafe.net
	Address:  204.244.119.1

	Name:    netblk-westel.cyberstore.net
	Address:  204.244.0.0

The nslookup ask the domain name server (dns) for an address resolution.
These names aren't one-to-one mapping. Some may have aliases.
You can also execute "nslookup www.cafe.net" and it'll give you the number.

Here's an example of traceroute:
% traceroute unixg.ubc.ca
traceroute to unixg.ubc.ca (137.82.27.7), 30 hops max, 40 byte packets
 1  capuccino.cafe.net (204.244.119.6)  155.769 ms  138 ms  139.993 ms
 2  bubbles.info-mine.com (204.244.118.254)  149.251 ms  138.992 ms  
129.521 ms
 3  s10.vgs2.westel.com (204.244.44.45)  148.945 ms  128.838 ms  129.518 ms
 4  s0/1.vgs1.westel.com (204.244.44.6)  139.571 ms  139.164 ms  129.522 ms
 5  border3-serial3-6.Seattle.mci.net (204.70.54.65)  149.119 ms  138.705 
ms  139.531 ms
 6  core1-fddi-0.Seattle.mci.net (204.70.2.145)  139.722 ms  249.549 ms  
139.426 ms
 7  border2-fddi-0.Seattle.mci.net (204.70.3.146)  159.265 ms  149.232 
ms  149.531 ms
 8  canet-networking-inc.Seattle.mci.net (204.70.53.6)  159.134 ms  
158.796 ms  159.92 ms
 9  psp2.bc.canet.ca (205.207.238.133)  168.86 ms  179.397 ms  139.24 ms
10  psp.bc.canet.ca (205.207.238.173)  169.582 ms  149.465 ms  149.21 ms
11  regional2.bc.canet.ca (192.68.61.102)  159.28 ms  179.116 ms  159.545 ms
12  wf-bcn.ubc.BC.net (142.231.109.6)  159.276 ms  159.599 ms  169.438 ms
13  anguhub14-142.net.ubc.ca (142.103.207.1)  159.27 ms  149.086 ms  
169.511 ms
14  cscihub1.net.ubc.ca (137.82.202.2)  148.964 ms  159.15 ms  149.986 ms
15  unixg.ubc.ca (137.82.27.7)  168.801 ms  149.316 ms  159.08 ms

This through my SLIP connection to cafe.net. It's a trace from 
cafe.net to unixg.ubc.ca. And look at that...it goes out to Seattle and
then come back. Helix's connection to SFU used to trace over to 
SanFrancisco, NewYork and WashingtonDC before coming back to Vancouver. 
These numbers are the gateway/bridges for separated networks.

You might not be able to run traceroute or nslookup because the sysadm 
is likely to restrict the permission. Also, traceroute won't work trying 
to prove through a firewall.

If you were on a windoze311/95 system, there isn't any nslookup.
However, on NT, there is one...but that usually comes with a DNS server.
Of course "TRACEROUTE.EXE" is out of the question because of the 
length...so, on the 8.3char system, they have "TRACERT.EXE".


: Also, how is it that some hits in an access log show up with the name of 
: the company or ISP, but others show up by ISP number only?  What is the 
: configuration difference?
Usually, program (such as telnet login) will try to resolve the 
number to a name. But if it isn't able to, it will use the number instead.
Some programs have switches or options to specify whether to resolve the
name or not. (Sticking with the number is faster.) Take for instance:

% netstat
Active Internet connections
Proto Recv-Q Send-Q Local Address          Foreign Address        
(State)       User
tcp        0      0 java7.cafe.net:1034    netinfo.ubc.ca:telnet  
ESTABLISHED   st2        
Active UNIX domain sockets
Proto RefCnt Flags      Type            State           Path
unix  2      [ ]        SOCK_STREAM     CONNECTED       2910
unix  2      [ ]        SOCK_STREAM     UNCONNECTED     3034
unix  2      [ ]        SOCK_STREAM     CONNECTED       3052
% netstat -n
Active Internet connections
Proto Recv-Q Send-Q Local Address          Foreign Address        
(State)       User
tcp        0      0 204.244.119.207:1034   137.82.27.44:23        ESTABLISHED
Active UNIX domain sockets
Proto RefCnt Flags      Type            State           Path
unix  2      [ ]        SOCK_STREAM     CONNECTED       2910
unix  2      [ ]        SOCK_STREAM     UNCONNECTED     3034
unix  2      [ ]        SOCK_STREAM     CONNECTED       3052

The second "netstat" was much much quicker than the first.

: Is it possible to do a lookup on .ca domains like you can with .com and .net
: domains (through whois)?  Or for that matter can one do a lookup on 
: .au and other country domains?
No, I don't think so. You can do a namelookup of a specify domain by:

% nslookup
Default Server:  espresso.cafe.net
Address:  204.244.119.1

> ls -d cafe.net 
[espresso.cafe.net]
 cafe.net.                      SOA   espresso.cafe.net  postgate.cafe.net. 
(951042 43200 3600 3600000 2592000)
 cafe.net.                      NS    espresso.cafe.net             
 cafe.net.                      NS    ns2.westel.com                
 cafe.net.                      MX    10   espresso.cafe.net
 cafe.net.                      A     204.244.119.1
 loghost                        CNAME espresso.cafe.net
 localhost                      A     127.0.0.1
 news                           A     199.60.229.6
...etc...(big list)...

To get a list, you have to use the correct server.
 ie: "ls -d infomatch.com" won't show anything if I'm using cafe.net's dns. 
Anyway, to get a listing of .ca, you would have to use the ".ca" 
server or "internic.org". I've tried both--none of them work. It says 
"Query Refused."


--
st2