On Thu, 11 Jan 2001, Crispin Cowan wrote:

> That would depend on who is doing the lookup. I'm far from an expert,
> as I've been investigating this particular area for three whole days.
> I knew it was out there, but web search engines weren't giving me any
> leads, and I only got something when slashdot posted a story
> mentioning infoswitch.com. Since then, I've learned of several other
> similar services, and Matt Barringerwirex wrote up a perl script that
> does the lookup using one of three services:
>
> * whois.arin.net
> * whois.ripe.net
> * whois.apnic.net
>
> These act like whois databases, but I'm unsure of their actual relationship to
> DNS.

They have little to do with DNS. ARIN, RIPE and APNIC are responsible
for doleing out the IP addresses to North America, Europe and Asia
respectively. For instance, running 'whois -a 208.161.110.91' gives us:

Cable & Wireless USA (NETBLK-CW-10BLK) CW-10BLK 208.128.0.0 -
208.175.255.255
Easystreet Online Services Inc. (NETBLK-CW-208-161-96) CW-208-161-96
                                                208.161.96.0 - 208.161.111.255

Then running 'whois -a NETBLK-CW-208-161-96' gives us:
Easystreet Online Services Inc. (NETBLK-CW-208-161-96)
   9705 SUNSHINE CT
   BEAVERTON, OR 97006
   US

And we know (as well as we can possibly know) that the IP originates in
the US. The downside is that if it's a shell machine, for instance, we're
fucked. That's where the big legal disclaimer comes in, I guess.

The part about 'foreign government domain name' I presume to mean '.ly'
as opposed to '.gov.ly'.

-- 
Matt Barringer
Adversary
WireX Communications, Inc.
Your random "E-speak" bullshit phrase for the day is:
"encourage frictionless e-business"
_______________________________________________
Stackguard mailing list
Stackguardmail.wirex.com
http://mail.wirex.com/mailman/listinfo/stackguard

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]