2 replies to this topic

[kique90]

Hi all,

First of all, tells you that I'm new to this commutity & forum, and I hope you can help me with the following stuff.

The question is, that if it is possible to create a basic software, or executable that may read a .txt file as follows:

192.168.1.111 to 67.202.66.172:WWW is accepted

192.168.1.111 to 72.36.210.254:WWW is accepted

192.168.1.111 to 67.202.66.203:WWW is accepted

192.168.1.111 to 200.74.121.11:DOMAIN is accepted

192.168.1.111 to 64.94.107.24:WWW is accepted

192.168.1.111 to 190.46.255.27:WWW is accepted

192.168.1.111 to 66.114.54.21:WWW is accepted

192.168.1.111 to 64.208.138.142:WWW is accepted

192.168.1.111 to 207.46.148.33:WWW is accepted

192.168.1.111 to 74.125.224.42:WWW is accepted

192.168.1.111 to 64.4.62.124:81 is accepted

the idea is that this program, could take the third colum ( destination ip ) and may apply a WhoIS method, as some webs, i.e: DomainTools | Whois Lookup & Domain Availability Search. So then create and output txt file that tells who is each ip in the log that was input. somethin like this:

67.202.66.172 is ip172.67-202-66.static.steadfast.net

152.74.16.83 is www.udec.cl

and so on.

well that's the idea.

regards,
Enrique

[gregwarner]

Absolutely, it's possible. Some strategies you could use:

You could use a string tokenizer to break the input up by whitespace, to get the third column. Then, to grab the IP address, you could either string tokenize again on the dot (".") character to grab the 4 octets one by one, or, use a regular expression matcher to match the pattern of an IP address. Or, simply look for the position of the colon (":") character and take everything before that.

Next, in order to perform a WhoIS query on the IP, that will be language-specific. If you know what language you want to write the program in (example Perl), your next step would be to Google the phrase "How to query WhoIS in Perl".

[Alexander]

A whois would certainly tell who owns the IP block, it will not explicitly state their host. The host of the IP address is defined by the IP block owner, and is called a reverse DNS record. There is nothing stating that a reverse DNS record has to exist, so you must handle if the result is just a plain IP address.

As it is host set, the reverse DNS entry may be false if there are more than one persons sharing the IP address, or explicitly set it to be false.
Reverse DNS lookup - Wikipedia, the free encyclopedia

Your example result works as ISPs tend to set a reverse DNS entry for every single IP address they lease, this is so it is easier to track and index each IP address. x.y.z.host.com is purely assigned by the host itself.