[ILUG] NSlookup..

[Thomas Bridge]

On Wed, 2 Jun 1999, John P. Looney wrote:

>  I was just looking at some web logs, and noticed that I was scanned by a
> few bots, one of which was something to do with www.ip2000.com. Any ideas
> how you can get a domainname out of an IP address (knowing that most IP
> addresses don't have DNS entries anywhere, though some machine on their
> network would have ?

Well - if the network is properly administered - just typing in 

nslookup 192.168.100.1

should give you the name of that host.    Unfortunately, they aren't
always properly administered.

Failing that, you could see who the IP block is delegated to.   To this
for an IP number, lose the last octet, reverse the remaining ones and then
add .in-addr.arpa.

Eg for the above IP number:

nslookup -q=ns 100.168.192.in-addr.arpa

will give you a list of the name servers capable of doing reverse lookups
for that subnet.     

You can also try http://ipindex.dragonstar.net/ (I think).

Bear in mind that the reverse information could be forged - there is
nothing to prevent an administrator setting up their IP to reverse back to
say, redbrick.dcu.ie

T.

Thomas Bridge			Hostmaster/Sysadmin, Medianet Ireland.
thomas.bridge at medianet.ie
"The nerds have taken over from the pervs" - anonymous news admin on noting
that comp.binaries.linux had overtaken all the porn groups as the most popular
group of the week,