tlug: Network Question

["Stephen J. Turnbull" <turnbull@example.com>]

>>>>> "Scott" == Scott Perlman <perlman@example.com> writes:

    Scott> Given a domain, how do I tell what IP ranges it owns.

This is generally given in the whois output for a single domain.  If
there are multiple matches you need to use the !HANDLE form.  Don't do 
this for say MCI, UUNet, or PSI ;-).

Often the domain name won't give you a single net.  Sometimes a single 
domain name will not have any associated ranges; I think you have to
trace the virtual hostings and so on for that.

It's often easiest to use a reverse lookup.

    Scott> Given and IPclass (A B or C) how do I find out who owns it?

Use `whois -h whois.arin.net ...' or whatever.  See the output from a
failed whois lookup at the end for a list of candidates for this:

Other associated whois servers:
   American Registry for Internet Numbers - whois.arin.net
   European IP Address Allocations        - whois.ripe.net
   Asia Pacific IP Address Allocations    - whois.apnic.net
   US Military                            - whois.nic.mil
   US Government                          - whois.nic.gov

If you use a single address, ARIN will trace all the way back up the
subnets.

Eg,

steve@example.com:xemacs-21$ whois -h whois.arin.net 208.135.107.17
MCI Internet Services (NETBLK-MCI-NETBLK10) MCI-NETBLK10
                                                 208.128.0.0 - 208.171.255.255
Satellite Communications (NETBLK-MCI-208-135-64-B) MCI-208-135-64-B
                                                208.135.64.0 - 208.135.111.255
Orbi-net (NETBLK-SAT-TEL-ORBI-NET2) SAT-TEL-ORBI-NET2
                                               208.135.105.0 - 208.135.108.255
Orbinet (Nodo Sucasa1) (NETBLK-ORBI-NOC1) ORBI-NOC1
                                               208.135.107.1 - 208.135.107.254

To single out one record, look it up with "!xxx", where xxx is the
handle, shown in parenthesis following the name, which comes first.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and nic.mil for NIPRNET Information.

I don't think APNIC (for Asia) or RIPE (for Europe) are so
accomodating (and they may want a canonical netblock address ending in
an appropriate number of zeros).  So it's hard to automate (believe
me, I've tried, tracking spammers by hand sucks).

-- 
University of Tsukuba                Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Institute of Policy and Planning Sciences        Tel/fax: +1 (298) 53-5091
---------------------------------------------------------------
Next Meeting: 10 October, 12:30 Tokyo Station Yaesu central gate
Featuring the IMASY Eng. Team on "IPv6 - The Next Generation IP"
Next Nomikai: 20 November, 19:30  Tengu TokyoEkiMae 03-3275-3691
---------------------------------------------------------------
Sponsor: PHT, makers of TurboLinux http://www.pht.co.jp