#####################################################################

~ INTERNET PROTOCOL ADDRESSES ~

#####################################################################


Ok , Not really a guide , more like a compilation of information

But as bruce would say "I can only show you the path, the rest is up to you".

If you have any questions or find a bad link or if you have anything good to add , please post it in the online security discussion forum , thanks ..

#####################################################################


For extensive information on IP Addresses , Internet Protocols and all the other good stuff try these links first:

Great Online Guide to TCP/IP :
http://www.redbooks.ibm.com/redbooks/GG243376.html

TCP/IP Guide:
http://www.tcpipguide.com/free/index.htm

Complete TCP/IP Resources Guide:
http://www.private.org.il/tcpip_rl.html

Bleeping Computers Guide to IP Addresses = Explained

http://www.bleepingcomputer.com/forums/ind...showtutorial=37

http://www.wbglinks.net/pages/reads/misc/ip.html

http://en.wikipedia.org/wiki/IP_address

http://www.dshield.org/primer.php

#######################################################################


Currently there are two types of Internet Protocol (IP) addresses in active use: IP version 4 (IPv4) and IP version 6 (IPv6). IPv4 was initially deployed on 1 January 1983 and is still the most commonly used version.

[quote]IPv4 addresses are 32-bit numbers often expressed as 4 octets in "dotted decimal" notation (for example, 192.0.32.67). Deployment of the IPv6 protocol began in 1999.

IPv6 addresses are 128-bit numbers and are conventionally expressed using hexadecimal strings (for example, 1080:0:0:0:8:800:200C:417A).[/quote]

Both IPv4 and IPv6 addresses are assigned in a delegated manner.

INTERNET REGISTRY IP ALLOCATION GUIDELINES:
http://www.arin.net/library/guidelines/ipv4.html
http://www.arin.net/library/rfc/rfc2050.txt


Users are assigned IP addresses by Internet service providers (ISPs).
ISPs obtain allocations of IP addresses from a local Internet registry (LIR) or national Internet registry (NIR),
or from their appropriate Regional Internet Registry (RIR):

[quote]APNIC (Asia Pacific Network Information Centre) - Asia/Pacific Region
ARIN (American Registry for Internet Numbers) - North America and Sub-Sahara Africa
LACNIC (Regional Latin-American and Caribbean IP Address Registry) – Latin America and some Caribbean Islands
RIPE NCC (Réseaux IP Européens) - Europe, the Middle East, Central Asia, and African countries located north of the equator[/quote]

The IANA's Role in the Internet:
The IANA serves as a bookkeeper in recording the assignments that are made.
In Internet terminology, the record-keeping service IANA performs is called a registration service, and IANA serves as a registry.

Allocation of IP Addresses:
The IANA maintains a high-level registry of IP addresses. It works with the Regional Internet Registries (RIRs) to distribute the large blocks of IP addresses among the RIRs. There are currently 4 RIRs, distributed around the world:
[quote] APNIC (Asia/Pacific Region), ARIN (North America and Sub-Sahara Africa), LACNIC (Latin America and some Caribbean Islands), and RIPE NCC (Europe, the Middle East, Central Asia, and African countries located north of the equator). (A fifth regional registry is in formation for Africa.)[/quote]

The RIRs are the organizations that actually allocate IP addresses to ISPs.
These allocations are in smaller blocks of addresses.


[quote]Allocate versus Assign
A distinction is made between address allocation and address assignment.
Internet Service Providers (ISP) are allocated address space as described herein, while end-users are assigned address space.  ARIN allocates blocks of IP addresses to ISPs for the purpose of subsequent distribution of that space to their customers.  An end-user is an organization receiving assignments of IP addresses exclusively for use within the Internet infrastructure they operate, not for sub-delegation of those addresses outside of its organization.[/quote]



The IANA web page "Internet Protocol v4 Address Space" documents how the IPv4 address space is distributed among the RIRs.

INTERNET PROTOCOL V4 ADDRESS SPACE:
- http://www.iana.org/assignments/ipv4-address-space


IANA – Internet assigned numbers authority

http://www.bluetack.co.uk/forums/index.php...?showtopic=1057

The IANA is not an ISP, and it has absolutely no control over the use of any Internet Protocol (IP) addresses except the very few that are directly tied to the iana.org domain name.

http://iana.netnod.se/


Whois searches with “IANA” as the result are either:

[quote]
·        Forged IP Address(the next "received" line up may be valid)

·        On your own network (virus generated e-mail).

·        On an IANA company computer.  This in not likely.[/quote]

IANA is the agency that assigns all internet number.

They assign IP’s to the Regional Internet Registries (RIRs) to re-distribute.

[quote]There are currently 4 RIRs, distributed around the world: APNIC (Asia/Pacific Region), ARIN (North America and Sub-Sahara Africa), LACNIC (Latin America and some Caribbean Islands), and RIPE NCC (Europe, the Middle East, Central Asia, and African countries located north of the equator). (A fifth regional registry is in formation for Africa.)  [/quote]

If the address is reported as being from IANA, you should try all 4 RIRs.

An IP address may report as being from IANA if they are:

[quote]"Private Use" IP addresses:
        10.0.0.0 - 10.255.255.255

        172.16.0.0 - 172.31.255.255

        192.168.0.0 - 192.168.255.255[/quote]

The above address blocks are reserved for use on private networks, and should never appear in the public Internet. If you see an apparent attack, or spam, coming from one of these address ranges, then either it is coming from your local environment, or the address has been "spoofed".

[quote]"Autoconfiguration" IP Addresses:
  169.254.0.0 - 169.254.255.255

Addresses in the range 169.254.0.0 to 169.254.255.255 are used automatically by some PCs and Macs when they are configured to use IP, do not have a static IP Address assigned, and are unable to obtain an IP address using DHCP.

This traffic is intended to be confined to the local network, so the administrator of the local network should look for misconfigured hosts. Some ISPs inadvertently also permit this traffic, so you may also want to contact your ISP.[/quote]

[quote]"Loopback" IP addresses:
        127.0.0.0 - 127.255.255.255

Each computer on the Internet uses 127.0.0.0/8 to identify itself, to itself. [/quote]

"Unallocated" IP addresses:
The IPv4 Address Registry and the Whois use the word unallocated (sometimes "reserved") to mean that the addresses are reserved for future allocation. No one should be using these addresses now.

[quote]Multicast IP addresses:
  224.0.0.0 - 239.255.255.255

Addresses in the range 224.0.0.0 to 239.255.255.255 are set aside for the special purpose of providing multicast services in the Internet.  These addresses are available for any host that wants to participate in multicast, and typically are assigned dynamically.[/quote]


Hints for Finding a Person Responsible for a Given IPv4 Address


Step 1 - :
Look up the IP address in the Regional Internet Registries (RIRs) "whois" servers. By using the "Whois" service, look up the IP address in all four Regional Internet Registries or RIRs. If the RIR Whois says the IP address is registered to the IANA, make sure you try the other RIRs to verify that they also say the IP addresses are registered to the IANA. (Some of the RIRs database may not have caught the latest delegations to other RIRs).

-American Registry for Internet Numbers
ARIN WHOIS Database Search;
- http://www.arin.net/whois/index.html

-APNIC Whois & Search;
Asia Pacific Network Information Centre
- http://www.apnic.net/search/

-RIPE
(Réseaux IP Européens)
- http://www.ripe.net/
- help: http://www.ripe.net/nicdb.html

-LACNIC:
The Latin American and Caribbean Internet Addresses Registry :
- http://lacnic.net/en/index.html

- African Region
The African Network Information Center (AfriNIC),
is the emerging organization that will administer IP allocation for Africa.
Web Site: http://www.afrinic.org

Step 2 - :
If all RIRs list an address as assigned to the IANA, you should check to see if this address is for "Special Use" or if it is "Unallocated" ("Reserved").

[quote]If the address that you are inquiring about does not have contact information in one of the RIRs, is not mentioned in the explanations above, or you have further questions, please send an e-mail to <ip-problems@iana.org> so that they may look into the problem further.[/quote]

--------------------------------------------------------------------------------

Information from IANA’s web pages: <http://www.iana.org/faqs/abuse-faq.htm>

-Whois (.aero,.arpa,.biz,.com,.coop,.edu,.info,.int,.museum,.net,and.org):
- http://www.internic.net/whois.html

#################################################################

What are CIDR netmasks?

[quote](Excerpt from url: http://public.pacbell.net/dedicated/cidr.html ) CIDR is an addressing scheme for the Internet which allows for more i efficient
allocation of IP addresses than the old Class A, B, and C address scheme.

CIDR Block  Equivalent Class C   IP Addresses Usable Addresses   Subnet Mask

   /32     1/256th of a Class C       1              1         255.255.255.255

   /30      1/64th of a Class C       4              2         255.255.255.252

   /29      1/32nd of a Class C       8              6         255.255.255.248

   /28      1/16th of a Class C       16             14        255.255.255.240

   /27      1/8th of a Class C        32             30        255.255.255.224

   /26      1/4th of a Class C        64             62        255.255.255.192

   /25       1/2 of a Class C        128            126        255.255.255.128

   /24           1 Class C           256            254         255.255.255.0

   /23           2 Class C           512            510         255.255.254.0

   /22           4 Class C          1,024           1022        255.255.252.0

   /21           8 Class C          2,048           2046        255.255.248.0

   /20          16 Class C          4,096           4094        255.255.240.0

   /19          32 Class C          8,192           8190        255.255.224.0

   /18          64 Class C          16,384         16,382       255.255.192.0

   /17          128 Class C         32,768         32,766       255.255.128.0

   /16          256 Class C         65,536         65,534        255.255.0.0

   /15          512 Class C        131,072        131,070        255.254.0.0

   /14         1,024 Class C       262,144        262,142        255.252.0.0

   /13         2,048 Class C       524,288        524,286        255.248.0.0

For more detailed technical information on CIDR, check out the following RFCs:

  * RFC 1517: Applicability Statement for the Implementation of CIDR
  * RFC 1518: An Architecture for IP Address Allocation with CIDR
  * RFC 1519: CIDR: An Address Assignment and Aggregation Strategy
  * RFC 1520: Exchanging Routing Information Across Provider Boundaries in the
    CIDR Environment[/quote]
RFCs are available at http://www.rfc-editor.org/rfcsearch.html

=====================================================================

~ BOGONS ~

http://www.cymru.com/Bogons/

Bogons is the name used to describe ip blocks not allocated by IANA and RIRs to ISPs and organizations plus all other ip blocks that are reserved for private or special use by RFCs (the actual term "bogons" comes from word "bogus", as in bogus ip announcements).

As these ip blocks are not allocated or specially reserved, such ip blocks should not be routable and used on the internet, however some of these ip blocks do appear on the net primarily used by those individuals and organizations that are often specifically trying to avoid being identified and are often involved in such activities as DoS attacks, email abuse, hacking and other security problems.

These activities obviously pose great danger to everyone and ISPs should try to filter all these bad ip routes and we are trying to help in that by working to create complete detailed list of unassigned bogon ips based on whois data.

Completewhois has developed a system that can track changes for all RIRs (we use whois database for ARIN, RIPE, APNIC and allocation statistics data for LACNIC), and on daily basis we produce new list of allocated and unallocated blocks and check if any unallocated blocks are in active use on the internet.

All this data is available in several formats, the most often used ones are below, for all other lists please see BOGONS IP LISTS page:

http://www.completewhois.com/bogons/bogons_info.htm


Also available are listing only for specific /8 or for RIR regions (ARIN, RIPE, etc), these you can find in various files in this directory (look for files that start with "activebogons" and "announced")

All currently available BOGONS in >> NETRANGE Format << (example: 10.0.0.0 - 10.255.255.255)
All currently available BOGONS in CIDR Bit Notation format (example: 10.0.0.0/8)
All currently available BOGONS in CIDR Netmask format (example: 10.0.0.0/255.0.0.0)
All currently available BOGONS in Dotted Decimal format (example: 10.0.0.0 255.0.0.0)

http://www.completewhois.com/bogons/bogonips_lists.htm

Bogus ASN Report
http://www.cymru.com/BGP/asnbogusrep.html

Below is a list of bogon (unallocated) ip blocks that are actively being routed and used on the internet right now (this list is updated once/day in the morning and reflects announcements and that time) and list of networks (ASNs) that are announcing those ips. You can also find this data in raw cidr format in this file and in raw text format (same as text below) in in this text file.
Updated April 2 2004 :
http://www.completewhois.com/bogons/data/d...on-cidr-all.txt


please check these sites for more information:

http://www.apnic.net/stats/bgp/TOTAL/totalbogus.html

Pataroo CIDR Report Announced Bogons - http://bgp.potaroo.net/cidr/#Bogons
Netatlantis Announced Bogons List - http://www.netlantis.org/index.html?menu=2...&page=listbogon

Bogon Presentatoin by Geoff Huston on RIPE meeting:
http://www.ripe.net/ripe/meetings/ripe-45/...5-eof-geoff.pdf

Bogon Route Servers page maintained by SixXS: http://www.sixxs.net/tools/brs/
and also their bogons information page: http://www.sixxs.net/tools/grh/bogons/

APNIC BGP Statistics (see bogus routes under it) - http://www.apnic.net/stats/bgp/

RF330 "Special-Use IPv4 Addresses" - ftp://ftp.rfc-editor.org/in-notes/rfc3330.txt


Tracking Spoofed IP Addresses
http://www.cymru.com/Documents/tracking-spoofed.html

[quote]Tracking spoofed IP addresses back to the source can be quite a difficult task. For myriad reasons, such as limited router access, attacks of a short duration, and the manual nature of spoofed address tracking, finding the actual generator of the spoofed packets can be very difficult. For this reason, attackers often use the bogon address ranges, where a bogon address range is any unassigned and likely unrouted (by BGP4 in the Internet) netblock.

This includes the RFC1918 addresses as well as a collection of other address spaces, such as 1/8, 169.254/16, and the like.

However, with a certain combination of features enabled on a Cisco router, it is possible to determine the source of the spoofed packets. Further, this can be done without the laborious and CPU intensive task of adding ACLs to filter the spoofed packets[/quote]


XX######################################XX
HIJACKED IPS
XX######################################XX

Hijacked IP space" are ip blocks that are being used without permission by organizations that have no relation to original organization (or its legal successor) that received the ip block.
In essence its stealing of somebody else's ip resources.

http://www.completewhois.com/hijacked/index.htm
http://www.completewhois.com/hijacked/hijacked_qa.htm
http://www.completewhois.com/invalidwhois/index.htm

[quote]Because most organizations actively use their ip blocks, they can easily notice if somebody else begins to use them (and network providers would usually not announce ip space that is already being announced somewhere else) and this would lead to immediate shutdown of improper ip block announcements, But there are number of old ip blocks where organization may not be aware that it has them and as such the ip block is not used on the internet, there are also some ip blocks that are "private" (i.e. used only inside organization on their local network) and are also not announced on the internet and then some organizations have too much ip space (the organization may have become smaller or its network more efficient) and they are not using ip space any more. These categories (ip blocks that are not in active use on the internet) are most common targets of ip hijackers. [/quote]

Current List of Hijacked IPs ":
http://www.completewhois.com/hijacked/hija...ced-details.txt

=================================================================


well heres everything you wanted to know about IP ADDRESSES:please READ IT !

http://www.wbglinks.net/pages/reads/misc/ip.html

--------------------------------------------------------------------------------------------------------

Subnet masking:
http://www.ipprimer.com/bitbybit.cfm

online Subnet calculators, can make life a little easier:

http://www.bluetack.co.uk/subnet.html
http://www.bluetack.co.uk/range2subnet.html
http://www.ipprimer.com/subnet.cfm

Great IP Subnet Calculators: (very handy).

- http://www.wildpackets.com
- http://www.solarwinds.com

============================

--------------------------------------------------------------------------------------------------------

More good stuff:
http://www.unixhub.com/docs/cisco/ccna.html


============================================================

Reporting network abuse: spamming and hacking:
what you can do with whois and how much information can you really get?
- http://www.apnic.net/info/faq/abuse/index.html


Sam Spade Library:
- http://www.samspade.org/d/

--------------------------------------------------------------------------------------------------------------


-WHOIS-
(Not all records are maintained or are totally reliable but a good place to start)

It is a protocol used to find information about networks, domains and hosts.
The whois records normally include data on the organizations and the contacts associated with these networks and domains.

To find details about the IP address you are searching for, simply enter it into the text box and click "Search Whois".

[quote]Remember that whois servers are being used and abused. Whois server administrators have responded with limits on how many lookups may be performed per minute, per day, etc.
If your internet connection has a permanent IP, you should be very careful while using public resources like whois servers. Make sure that your IP doesn't find its way into various registrar ban lists.[/quote]


so dont get banned it makes things a little bit harder.


one good hint is to do DNS lookups from your computer to your isps DNS server (with your whois tools),
as they will possibly have cached requests so that you wont need to look any further.
to find your isp dns server , go to start > run > type cmd.exe [xp] or command.exe [98/me]

in command prompt type: ipconfig/all , at the bottom will show your ISP DNS SERVER IP addresses.

==================================================================

Many operating systems provide a WHOIS utility.

To conduct a query from the command line, the format is:

whois -h hostname identifier e.g. whois -h whois.arin.net <query string>

To obtain a more specific response, you may conduct a search by using certain flags. Many of these flags can be combined to indicate the desired output. Flags must be separated from each other and from the search term by a space. Your results will vary depending on the refinements you apply in your search. Listed below are the flags currently available; you may only use one flag from each flag-type in a query (i.e. one record type, one attribute, etc.).

Query-by-record-type:
To limit your query to a specific record type, include one of the following flags:

n Network address space 
a Autonomous systems
p Points of contact
o Organizations
c End-user customers

Query-by-attribute:
To limit your query to a specific record attribute, include one of the following flags:

@ <domain name> Searches for matches by the domain-portion of an e-mail address
! <handle> Searches for matches by handle or ID
. <name> Searches for matches by name

Searches that retrieve a single record will display the full record. Searches that retrieve more than one record will be displayed in list output.

Display flags:
To modify the way that the query results display, include one of the following flags:

+ Shows detailed (aka 'full' output) display for EACH match
- Shows summary only (aka 'list' output), even if single match returned

The + flag cannot be used with the sub-query feature described below.

-----------------------------------------------------------------

How do you find out what IP range a website / company uses:
http://www.bluetack.co.uk/forums/index.php...?showtopic=1067

=----------------------------------------------------------------
Using your firewall logs or connection viewers to gather suspicious IPs is just the start, then the search for information on those ips begins....

i usually start with a WHOIS search, maybe i will try a few different places if i dont get what im looking for...google the IP address can sometimes bring up results as well , so never forget to use google before you go off in other places looking for the information and spam databases can be helpful.

yes they are a little bit evil , thats why they are so good.
- http://www.google.com/

After the WHOIS , i sometimes choose to to a TRACEROUTE on the IP to get a closer look at the network it belongs to.

- great WHOIS Overview :
- http://navigators.com/whois.html

- great TRACEROUTE Overview:
- http://navigators.com/traceroute.html

-Excellent Online Internet search tools page;
Whois-traceroute-domain name lookups etc

- http://www.samspade.org/
- http://www.dnsstuff.com/
- http://www.completewhois.com/ <- thanks to Redzulu for the link..
- http://www.ratite.com/whois/whois.cgi
- http://combat.uxn.com/
- http://www.network-tools.com/
- http://www.tom-cat.com/lookup.html

IP whois: Dshield also gives you statistics on some attacking ips - if they are very active etc...
- http://www.dshield.org/ipinfo.php?ip=XXX.XXX.XXX.XXX
- http://www.whoisview.com/support/kb/ipwhois.php

-Wildcard searches are recommended fun activities by DDD :
(try baytsp* for a good starting point )
- http://ws.arin.net/cgi-bin/whois.pl

-Domain Name Lookup/Whois Page
- http://www.networksolutions.com/cgi-bin/whois/whois

- http://www.traceroute.org/
- http://www.cybergeography.org/atlas/routes.html :Traceroute:visual tracking.
- http://www.geektools.com/traceroute.php

===========================================================

an important aspect of security while connected to the internet is the ability to view all IP connections to your computers virtual ports (65535), there are many tools to let you do this, some are even already built into windows.

Read the Firewall and Trojan protection guides for further security information..


ok the most simple way to view IP connections to your computer is to use netstat ,
which is already a part of all windows operating systems and ready to be used,
just run it from the command prompt.

(although i prefer to use TCPView and you will too!)

for windows users:
all you need to do is go to START > run > type: cmd (for xp)
and START > run > type: command (for win98)

ok then type in: netstat ?
that should bring up the list of commands you can use...
and try...: netstat -an


NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the -p option may be used to specify a subset of the default.
interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.


there are dos utilities like the sniffer INETWATCH and F-PORT that are much better than Netstat, so if you like command line stuff , try them out too..or go all out and get windump and winsnort..

-----------------------------------
----------------

Using Netstat help/INFO:
http://www.computerhope.com/netstat.htm
http://www.hackinthebox.org/article.php?sid=4858

The Art of Interpreting Netstat :
http://www.winnetmag.com/Article/ArticleID...0316/40316.html

great TCP/IP information page
http://www.private.org.il/tcpip_rl.html

-------------------------------------------------------------------------------------------------------------------


-Traceroute-

- http://www.freesoft.org/CIE/Topics/54.htm
- http://www.computerhope.com/tracert.htm

A utility that traces a packet from your computer to an Internet host, showing how many hops the packet requires to reach the host and how long each hop takes.

Windows includes a traceroute utility called tracert.

In Windows, you can run tracert by selecting Start->Run…, cmd or command (xp or 9x) and then entering tracert followed by the domain name of the host.
For example:

tracert www.pcwebopedia.com

tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name

Options:

-d Do not resolve addresses to hostnames.
-h maximum_hops Maximum number of hops to search for target.
-j host-list Loose source route along host-list.
-w timeout Wait timeout milliseconds for each reply.


[quote]Traceroute transmits packets with small TTL values. Recall that the TTL (Time To Live) is an IP header field that is designed to prevent packets from running in loops. Every router that handles a packet subtracts one from the packet's TTL. If the TTL reaches zero, the packet has expired and is discarded. Traceroute depends on the common router practice of sending an ICMP Time Exceeded message, documented in RFC 792, back to the sender when this occurs. By using small TTL values which quickly expire, traceroute causes routers along a packet's normal delivery path to generate these ICMP messages which identify the router. A TTL value of one should produce a message from the first router; a TTL value of two generates a message from the second; etc. [/quote]
[quote]``Traceroute'' is a network debugging utility that attempts to trace the path a packet takes through the network - its route. A key word here is ``attempts'' - by no means does traceroute work in all cases. [/quote]


============================================================

other free tools you can use for monitoring IP connections besides using a good personal firewall and [not free] TDS-3 include:

Tcpview
Tdimon
Netmon
Netstat viewer

theres probably a hundred and one other tools out there to do the same thing

unfortunately some port monitors can supposedly be bad.
read GRCs spin on evil port monitors

[quote]Spotting an Evil Port Monitor . . .

The rule of thumb is simple: Internet monitors should JUST monitor. They should NOT alter the exterior "open port profile" of your computer as seen from the Internet. Yet monitoring without opening ports is MUCH more difficult and requires system-level programming expertise. The products I mention on the next page are able to do it, and my forthcoming freeware firewall will too, but I'm unaware of any other free software that can. [/quote]

i recommend Tcpview for exactly these reasons:
- its free (unknown obviously to mr.gibson)
- you can and should be able to block all outbound/inbound connections and still use it without any problem,
solving the evil port monitor problem of exposing your system-
eg : it should be placed in untrusted firewall zone and operate normally, it just wants to connect to DNS port otherwise.

The only program that should have access to the net is your firewall, and all your programs should run its connections through it for basic security.

----------------------------------------------------------------

TCPView

is one of the greatest freeware program on the net, runs on all window$ versions and will show you
: detailed listings of all TCP and UDP endpoints on your system,
including the local and remote addresses and state of TCP connections.

; allows you to close the connections by right click or kill the process, or just get more info on the application.

On Windows NT, 2000 and XP TCPView also reports the name of the process that owns the endpoint.
TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows.

http://www.sysinternals.com/ntw2k/source/tcpview.shtml

more excellent free utilities here from Sysinternals.com. [^]

others worth checking out are ..
process explorer,autoruns,tdimon,filemon,portmon,access enum and a whole lot more...
http://www.sysinternals.com/sitemap.shtml

-------------------------------------------------------------------

The following programs also allow you to look up ips using various methods from your own computer:

--------------------------------------------------------------------

The Bluetack Blocklist Manager

is the best freeware IP management tool on the net in my opinion,
many handy internet tools and other good stuff, get it youll like it and you wont need much else.

http://www.bluetack.co.uk/forums/index.php?c=3

=------------------------------------=-------------------------------------=--------------------------=

Sam Spade

Sam Spade is an integrated network query tool for
Windows 95, 98, NT4.0 & Windows 2000-XP.
It's freeware.
Some Things That It Does;
ping!, nslookup, whois, IP block whois, dig, traceroute,
finger, SMTP VRFY ,web browser,, keep-alive, DNS zone transfer SMTP relay check, Usenet cancel check,
website download, website search, email header analysis, Email blacklist query, Abuse address query,
S-Lang scripting--Very Good Program!

Download
features

-----------------------------------------------------------------------------------------------------------------

Whoisview:
WhoisView is a Windows and Mac OS X software tool for finding the owner of an IP block or domain name.

The main feature of WhoisView is its simplicity. Type in a host name or IP address and it will retrieve the ownership information by digging through various authoritative whois servers. WhoisView will find information all other similar tools are unable to or don't bother to locate.

http://www.whoisview.com/products/whoisview/


--------------------------------------------------------------------------------------------------------------------


NS-Batch :

JIM PRICE created this utility to allow host name lookups of lots of IP addresses.
It also lets you interactively look up host name from IP addresses or IP addresses from hostnames.
Just feed it a file with IP addresses in it (of the format 127.0.0.1), and it will dig out the addresses,
look up the hostnames, and create a text file containing:

1) the IP address in hex (useful for sorting)
2) the IP address in dotted-octet format (i.e., 207.43.183.2)
3) the corresponding hostname, (i.e., www.jimprice.com) and
4) the hostname reversed (i.e. com.jimprice.www)
5) additional status information about the lookup (whether or not it worked)

You can then import the text file into your favorite word processor, spreadsheet, or other program, and sort it by IP address or other fields. Also, the program now includes features to probe a subnet (listing all the computers on a given network), and to display your local host's IP address, as well as some amount of flexibility in the output format.

- http://www.jimprice.com/jim-soft.htm#nsbatch

----------------------------------------------------

NeoTrace Express 3.25

NeoTrace Express is a freeware version of the popular NeoTrace tool. This version offers the mapping features of the Professional version and the essential features you need to trace web sites. It's multithreaded, so it's very fast and can simultaneously check multiple hops on the route. It shows the route on a world map with detail on the path taken by your Internet traffic. NeoTrace Express can integrate with Internet Explorer to offer one-click tracing to web sites and URLs.
Features include:
tracing websites and IP addresses
viewing a world map with the results of the trace viewing the network information associated with the trace destination

http://www.networkingfiles.com/PingFinger/...raceexpress.htm


----------------------------------------------------

uh oh - traceroute is usually blocked by firewalls.

But there is a TCP traceroute option here: - http://michael.toren.net/code/tcptraceroute/

[quote]tcptraceroute is a traceroute implementation using TCP packets.
The more traditional traceroute(8) sends out either UDP or ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets are taking to reach the destination.

The problem is that with the widespread use of firewalls on the modern Internet, many of the packets that traceroute(8) sends out end up being filtered, making it impossible to completely trace the path to the destination. However, in many cases, these firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the firewall are listening for connections on. By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters.

It is worth noting that tcptraceroute never completely establishes a TCP connection with the destination host. If the host is not listening for incoming connections, it will respond with an RST indicating that the port is closed. If the host instead responds with a SYN|ACK, the port is known to be open, and an RST is sent by the kernel tcptraceroute is running on to tear down the connection without completing three-way handshake.

This is the same half-open scanning technique that nmap uses when passed the -sS flag. [/quote]

-------------------------------------------------

3d Traceroute - visual traceroute tool

3d Traceroute full blown three dimensional traceroute program that allows you to visually monitor internet connectivity. It offers an attractive and fast loading 3D interface as well as optional text results. The 3D graphs can be manipulated by rotation, zoom and several other options. You can also record and playback individual traces for detailed investigation. 3d Traceroute also offers statistical displays as well as keeping track of trace history.
Additional support is offer for OpenGL interface. Very nice tool!
Working with 98, ME, NT, 2K, XP
and if you are lucky, 95, too.

http://www.hlembke.de/prod/3dtraceroute/
FAQ:
http://www.hlembke.de/prod/3dtraceroute/faq.htm

---------------------------------------------------

HYPER TRACE-
AnalogX HyperTrace is a GUI version of traceroute, which shows you the route that information travels from your machine to another machine on the internet. Of course, AnalogX wasn't happy just making a GUI version, HyperTrace is also faster, and not just a little bit; an average of 20-30x faster than before! It displays each hop, machine name, machine response time, and the route TTL.

http://www.analogx.com/contents/download/n...work/htrace.htm

-------------------------------------------------------------------------

XIPL is an small freeware utility for offline retrieving the country information from IP-address or hostname,
viewing IP-address blocks allocated for specified countries and seeking the country by code or code by country.

info page:
http://www.irnis.net/soft/xipl/

Download page:
http://www.irnis.net/free.shtml

==============================
--------------------------------------------
~HELP/HISTORY/INFORMATION~
--------------------------------------------
==============================


-American Registry for Internet Numbers
ARIN WHOIS Database Search;
- http://www.arin.net/whois/index.html


-APNIC Whois & Search;
Asia Pacific Network Information Centre
- http://www.apnic.net/search/

-RIPE
(Réseaux IP Européens)
- http://www.ripe.net/
- help: http://www.ripe.net/nicdb.html

-LACNIC:
The Latin American and Caribbean Internet Addresses Registry :
- http://lacnic.net/en/index.html

- African Region
The African Network Information Center (AfriNIC),
is the emerging organization that will administer IP allocation for Africa.
Web Site: http://www.afrinic.org

-Whois (.aero,.arpa,.biz,.com,.coop,.edu,.info,.int,.museum,.net,and.org):
- http://www.internic.net/whois.html

------------------------------------------------------------------

-Look up Ip Blocks
- http://www.networkinformation.com/ip/ipind...ndex/index.html

----------------------------------------

- IANA : Internet Assigned Numbers Authority:
- http://www.iana.org

-The Internet Corporation :
for Assigned Names and Numbers
- http://www.icann.org/

-Internet Authorities and Entities :
- http://www.elfqrin.com/docs/internetentities.html

-Private Internet Addresses :
- http://www.faqs.org/rfcs/rfc1918.html

-How Reverse DNS Works:
- http://www.dnsstuff.com/info/revdns.htm

Connected: An Internet Encyclopedia
- http://www.freesoft.org/CIE/index.htm


-Internet Protocol Addressing
- http://www.samspade.org/d/ipdns.html


-Gude to submitting IP attacks to isp:
- http://www.computer-forums.co.uk/forum/vie...424345ab7d7be75


a good read is this guide to tracing software pirates:
- http://www.cat-soft.com/Tracing.htm


About spam/tracing e-mail & How to avoid spam
- http://www.computer-forums.co.uk/forum/vie...31a991985baf13a


================================================================

- Generic TLDs -

[quote]
In the 1980s, seven gTLDs (.com, .edu, .gov, .int, .mil, .net, and .org) were created.
Domain names may be registered in three of these (.com, .net, and .org) without restriction;
the other four have limited purposes.

Over the next twelve years, various discussions occurred concerning additional gTLDs,
leading to the selection in November 2000 of seven new TLDs for introduction.
These were introduced in 2001 and 2002. Four of the new TLDs (.biz, .info, .name, and .pro) are unsponsored.
The other three new TLDs (.aero, .coop, and .museum) are sponsored.

Generally speaking, an unsponsored TLD operates under policies established by the global Internet community directly through the ICANN process, while a sponsored TLD is a specialized TLD that has a sponsor representing the narrower community that is most affected by the TLD.
The sponsor thus carries out delegated policy-formulation responsibilities over many matters concerning the TLD.
http://www.icann.org/tlds/[/quote]


-----------------------------------------------------------------------------------------


RIPE Network Coordination Centre
Spamming / Hacking / Connectivity Issues

· What is the RIPE NCC?
· Finding the correct database
· Finding contacts for an IP address

What is the RIPE NCC?
[quote]The RIPE NCC is a Regional Internet Registry (RIR).
This means we allocate address space to ISPs and other organisations.
These organisations are responsible for the activities originating from the address space allocated to them.
Since the RIPE NCC is not the organisation using or responsible for activities originating from the address space,
any concerns or responses should be directed to them and not the RIPE NCC.

You are welcome to use the RIPE NCC Whois Database to locate details of IP address registrations
within the RIPE NCC service region.
However, the RIPE Database does not contain information on all IP addresses in the world.
There are four RIRs that allocate IP addresses to organisations in their service regions
and store information about those addresses in a Whois database.[/quote]

Finding the correct database:


To find the correct database containing information on an IP address you should first find the appropriate allocation block.
A list of allocation blocks with the corresponding RIR can be found at:

http://www.iana.org/assignments/ipv4-address-space

For example, if your IP address begins with "193" you should locate this range within the list:

193/8 May 93 RIPE NCC (whois.ripe.net)

In this example you can see that address space beginning with "193" has been allocated to the RIPE NCC
and therefore you should use the RIPE Database (whois.ripe.net) to search for the responsible party.


If the allocated block states "Various Registries" you are required to search all four RIR databases until the contact information is found.
The 4 RIRs are:

ARIN, for North America and African countries located south of the equator
(Whois database on 'whois.arin.net'; Web interface available.)
LACNIC, for South America and the Caribbean
(Whois database on 'whois.lacnic.net'; Web interface available.)
RIPE NCC, for Europe, Central Asia, the Middle East and African countries located north of the equator
(Whois database on 'whois.ripe.net'; Web interface available.)
APNIC, for Asia and the Pacific region
(Whois database on 'whois.apnic.net'; Web interface available.)

Finding contacts for an IP address
To find the contacts responsible for address space that originates
within the RIPE NCC service region please use the RIPE Whois Database for example:

Enter the IP address into the Whois search box.

The output will list a number of objects. Firstly an inetnum object:

inetnum: 193.0.0.0 - 193.0.1.255
netname: RIPE-NCC
...

The last objects listed will be person or role objects that detail the persons responsible
for the administration of the IP address. Please check these objects for remarks
on who to send e-mails on spamming, hacking or connectivity issues.
If you are unable to find any remarks please use the e-mail address included within the object.

For example:

[quote]
person:  John P.diddy Smith
address: Example LTD
         Very High street 12
         St.Mery Mead
         Essex, UK
phone:   +44 1737 892 004
e-mail:  john.smith@example.com
nic-hdl: JS9-TEST
mnt-by:  EXAMPLE-MNT
remarks: *******************************
remarks: This object is only an example!
remarks: *******************************
changed: john.smith@example.com 20020827
changed: john.smith@example.com 20020828
source:  TEST
Please only use the e-mail address specified in the "e-mail" attribute.
Do not send mails to the other e-mail addresses within the objects because
these e-mail addresses are used for specific purposes in the RIPE Database.
Therefore messages may not be directed to the correct party.

Please also be aware that the person listed in the object may be only
an employee of the organisation responsible for the address range
and may not be the individual using the specific IP address.

If you are unsuccessful in locating the responsible contact person,
you may write to ripe-dbm@ripe.net.
We will try to help you find the appropriate contact details.
Please include the IP address that you are researching in your e-mail request. [/quote]


=======================================================


Q: What is a domain name?

A: Practically speaking, your domain name (Web address)
is the core of your Internet identity, your online brand.
Your customers will remember this name and use it to find your Web site,
your products or your services.
And since no two parties can ever hold the same domain name (Web address)
simultaneously, your Internet identity is totally unique.

Technically, a domain name (Web address) is an addressing construct
used for identifying and locating computers on the Internet.
While computers use Internet Protocol (IP) numbers to locate each other on the Internet,
people find them hard to remember.
Therefore, domain names (Web addresses) were developed to permit
the use of easily remembered words and phrases to identify Internet addresses.

For example, the domain name (Web address)
networksolutions.com represents Network Solutions Web sites.
When you type networksolutions.com into a Web browser
or send e-mail to someone at networksolutions.com,
the Domain Name System (DNS) trans

###################################################################

Helpful Information from the Glossary page of Fixed Orbit:

http://www.fixedorbit.com/glossary.htm

[: Autonomous System (AS) :]

An Autonomous System (AS) is a group of IP networks operated by one or more network operator/s which has a single and clearly defined external routing policy. Exterior routing protocols are used to exchange routing information between Autonomous Systems.

[: Autonomous System Number (ASN) :]

A public AS has a globally unique number, an Autonomous System number (ASN), associated with it; this number is used in both the exchange of exterior routing information (between neighboring Autonomous Systems), and as an identifier of the AS itself.

There are two types of Autonomous System numbers; Public AS numbers and Private AS numbers.

[: Border Gateway Protocol (BGP) :]

Border Gateway Protocol (BGP) is the protocol used to determine how to route data from one point on a network to another. At it's simplest, BGP says that a certain IP is controlled by a certain AS, then the router looks to see the closest AS in it's table to get to the end point, the data is handed to that network, and the cycle continues until the end point is reached.

[: Domain :]

A domain name locates an organization or other entity on the Internet. For example, the domain name www.analogx.com locates an Internet address for "analogx.com" at Internet point 63.166.232.200 and a particular host server named "www". The "com" part of the domain name reflects the purpose of the organization or entity (in this example, "commercial") and is called the top-level domain (TLD) name. The "analogx" part of the domain name defines the organization or entity and together with the top-level is called the second-level domain name. The second-level domain name maps to and can be thought of as the "readable" version of the Internet address.

[: IP Address :]

In the most widely installed level of the Internet Protocol (IP) today, an IP address is a 32-bit number that identifies each sender or receiver of information that is sent in packets across the Internet. When you request an HTML page or send e-mail, the Internet Protocol part of TCP/IP includes your IP address in the message (actually, in each of the packets if more than one is required) and sends it to the IP address that is obtained by looking up the domain name in the Uniform Resource Locator you requested or in the e-mail address you're sending a note to. At the other end, the recipient can see the IP address of the Web page requestor or the e-mail sender and can respond by sending another message using the IP address it received.

An IP address has two parts: the identifier of a particular network on the Internet and an identifier of the particular device (which can be a server or a workstation) within that network. Each octet from left to right on an IP address narrows the scope of what it's describing, so the last octet is what uniquely identifies a particular server.

[: Knodes Index :]

Not to be confused with a network Node, our Knodes Index is our measure of how a network provider compares to others - the higher the Knodes index, the better the network. If you're wondering what the name means, it represents the analysis FixedOrbit performs (the Knowledge) with the network topology (the Node), in a sorted order (the Index) - put it all together, and you get the Knodes Index.

[: Network :]

In information technology, a network is a series of points or nodes interconnected by communication paths. Networks can interconnect with other networks and contain subnetworks.

[: Node :]

A network node is machine/device connected to a network. This could be anything from a router to a webserver and can be an endpoint or a hop inbetween.

[: Peer :]

A peer is another network with which a network has made an arrangement to exchange Internet traffic traffic.

[: Peering :]

Peering is the arrangement of traffic exchange between Internet service providers (ISPs). Larger ISPs with their own backbone networks agree to allow traffic from other large ISPs in exchange for traffic on their backbones. They also exchange traffic with smaller ISPs so that they can reach regional end points.

[: Point of Presence (POP) :]

A term originally coined by the Ma Bell, a point of presence (more commonly know as a Pop) is a physical connection point between the real world and a network. Examples of Pop's would be data centers, telephone company switching centers, and virtually any other location that network devices can be installed.

#####################################################

##########################################################

IP INDEX SITES

##########################################################

http://www.flumps.org/ip/index.html

http://www.fixedorbit.com/welcome.htm

DIG Pages:
http://www.freesoft.org/CIE/Topics/35.cgi
http://www.freesoft.org/CIE/Course/Section2/13.

NETWORK SEARCH:

Search by domain or IP
Search for a network that supports a specific domain name or IP address.

Search by name or description
Search the database for information about a specific network by name or description.

Search by ASN
Search if you know a specific network's ASN.

http://www.fixedorbit.com/search.htm


AS TRACE:

http://www.fixedorbit.com/trace.htm

=====================
AS Numbers and NIC Handles
=====================

AS Numbers (RFC 1930)

The Autonomous System (AS) numbers are used by various routing protocols.
AS numbers are allocated to the regional registries by the IANA.

These registries are ARIN <hostmaster@arin.net> for the Americas, Carribbean, and Africa, RIPE-NCC <ncc@ripe.net> for Europe, and the APNIC <helpdesk@apnic.net> for the Asia Pacific region.
AS Numbers can be obtained from the registry in your region.

A text file of the lat/long coordinates and degree data for ASes displayed in the Apr 2002 visualization is available
HERE!


Another AS Search Page:
http://www.caida.org/cgi-bin/reversetracer...e/assearch.cgi/


1 BBNPLANET
101 WASH-NSF-AS
104 COLORADO-AS
109 CISCOSYSTEMS
114 SESQUINET-AS
12 NYU-DOMAIN
1205 JKU-LAN-ASN-AS
1206 PSCNET-HS-AS
1221 AARNET-AS
1224 NCSA-AS
1225 CICNET3-AS
1227 SDSC-TEST1-AS
1237 KREONET
1239 SprintLink
1241 GR-AUTO-AS
1248 NOKIA-AS
1251 ANBR-AS
1257 SWIPNET-AS
1267 IUNET-AS
127 JPL-AS
1270 - 1275 UNIDO-AS
1280 CIX-AS1
1290 UKNET-AS
1300 - 1309 FRANCE-ASNBLOCK-AS
1342 NOKIA-DATA-AS
137 ITALY-AS
144 ATT-INTERNET
145 VBNS
1653 SUNET
1659 TANET-ASN1
1706 UNIV-ARIZ
174 NYSERNET-AS
1740 CERFNET
1741 FUNET
1746 DRANET-AS
1749 NASA-GSFC-AS
1754 DESY-HAMBURG
1755 EBONE-INTERNAL
1759 DATANET
1761 DPT-INFO-RES
1767 IHETSDATANET
177 MERIT-AS
1781 KAIST-NET1
1784 SPRINTLINK
1785 SPRINTLINK-NYSERNET3
1800 ICM-Atlantic
1804 ICMNET-6
1830 IACNET2
1833 UNINET
1835 DENET
1836 EUNET-CH-AS2
1840 UDLAP-NET
1849 PIPEX-AS
1850 SURIS
1853 AT-BONE
186 CUA-AS
1877 - 1901 ASNBLK-RIPE
188 SAIC-AS
1902 FESNET-L
1909 ALPHA-NAP-AS
1913 DLA4
1916 RNP-AS
1930 RCCNET
195 SDSC-AS
1955 HBONE
1968 UMASSP-DOM
1982 ASN-NWNEXUS
1984 BUMEDSIGONEL
1998 STATE-OF-MN
20 UR
2012 UNINET1
2015 MSEN-SYSTEM
2018 UNINET-ZA
2028 BNRUK-AS
2033 Panix
2041 CRL-GATE
2048 LANET-1
2055 LSU-1
2056 AOL-AS
209 WESTNET-EAST
2140 ISSC-AS
2149 PSINET-2
2150 CSUNET-SW
22 NOSC
226 LOS-NETTOS-AS
2277 ECUANET
234 NSFNETTEST11-AS
237 NSFNETTEST14-AS
2379 UNIT-TEL-FLA
2380 ESTNET
2381 WISCNET1-AS
24 AMES-NAS-GW
2493 FONOROLA-EAST
2529 DEMON-SYS
2547 BMENET-AS
2548 DIGEX-AS
2551 NETCOM-AS ]
2553 FSU-AS
2554 INTER-GRP-A
2561 FRCU-EUN
2563 KREN-GATEWAY
2568 CTSNET
2572 MORENET
2578 RELCOM-DEMOS
2585 - 2614 ASNBLK-RIPE
2635 CENTEL-NV
2637 GEORGIA-TECH
2683 RADIO-MSU
2697 ERNET-AS
2698 IASTATE-AS
270 PSCNI-AS
2707 WEC
271 BCNET-AS
2711 SUNBELT-AS
2715 REDERIO-AS
2764 CONNECT-NET
2766 GLASNET
2767 UNITEL_CBMS
2773 - 2822 ASN-BLKRIPE2
278 RAM-AS
2828 INTERNEX
284 UUNET-AS
286 EUNET-AS
288 ESA-AS
2895 FREE-NET-AS
2900 WN-AZ
2901 WN-NM
2905 TICSA-ASN
2907 SINET-AS
291 ESNET-EAST-AS
2914 LITTLE-GARDEN
2915 SPIN-NET
2917 OLEANE
2920 LACOE
293 ESNET-WEST-AS
2933 REALTIME
2939 SCAROLINA-AS
295 OSI-GW-AS
297 NSN-UMD-AS
303 NPRDC-AS
3058 EMNET
3064 CYBER-ASN
3082 ADVANTIS
3112 OARNET-AS-1
3132 RCP-AS
3136 STATE1-AS
32 STANFORD
3354 THENET-AS-1
3356 GLOBALNET
3384 NEW-YORK-NET
34 UDELNET
3403 TIAC
3404 COLORADOCOOP
3407 INTERPATH-NC
3447 CENTEL-CMDS
3450 UTK
3452 UAB-AS
3462 HINET-AS
3463 ACES-AS
3464 ASC-NET
3479 PEACHNET-AS1
3488 SPACENETJP
3491 CAIS-ASN
3493 INTERLINK
3505 VNET-GA
3549 IMPACT
3554 USIT-ASN
3557 VIX
3561 MCI-RESTON
3581 OBS-NET
3593 EPIX
3596 TELEAUM
3597 NET-RETINA
3602 INSINC
3608 NBNIC-NCA
3632 CONACYT
3669 IQUEST
3670 OPTIMUM-AS
3701 NERONET
3720 TIMS-AS
3728 ONR-ADDR
3734 SJEN
3737 PTD-AS
3739 NEWNET
3741 IS
3742 SEMAPHORE-1
3746 IPAC-WORLD
3749 TECNET
3751 SNET-AS
3758 SINGNET
376 RISQ-AS
3768 DIALOG-AS
378 ILAN-AS
3786 DACOMNET
3796 OUTERNET
3799 IDS
38 UIUC
3801 MISNET
3803 ULTRA-MA
3807 UMTNET-ASN
3814 IMS-INTERCOM
3816 SAITEL-CO
3817 FREESIDE-NET
3819 SIGNET
3831 FIBRNET-B1
3840 LABTAM
3845 STATE-NET
3847 IMN
3857 INC
3900 TEXASNET
3908 - 3912 WNBLK-AS
3914 DX-NET
3925 ICO-SV
3932 VOICENET
3951 ICONNET
3967 NETUSACOM-AS
3976 NURI-ASN
3996 FIRN
3999 PENN-STATE
4000 - 4005 GLOBAL-SPLK
4006 NETRAIL
4039 ALBANYNET
4058 LINKAGENET
41 AMES
4134 CHINALINK
4136 USCYBER
4141 ICA
4148 ACTCOM
4167 CONNECTSOFT-COM
4181 TDS-AS
4183 COMPUSERVE
4193 WA-STATE-GOV
4198 RADIXNET
4200 AGIS-NET
4222 LEN-NET
4223 CONNIX
4230 EMBRATEL-BR
4231 FASTNET-ASN
4262 - 4269 CERNET-ASN-BLOCK
4274 AU-NET
4276 INCH
4277 KIVEX
4310 LINET
4314 COMMNET-ASN
4323 TW-COMM
4327 SNA-NET
4358 XNET
4374 CONNECT
4432 CSTONE-NET
4433 ACCESS-ONE
4436 AS-SCRUZ-NET
4454 TNET-AS
4459 KDD-NET
4470 ASN-CITENET
4472 IONET
4493 UNI-SON
4494 INTERBYTES
4511 MIAMI-EDU
4513 TIG
4527 BRAINSTORM
4538 CERNET-BKB
4540 WELL
4544 CONXION-A
4550 AN-CMSPP
4565 HLC-INTERNET
4569 ASHTON-NET1
4591 SYRANET-GW
4740 WORLDS-SEA
48 NRL-AS
4908 CRC-ASN
4911 USW-INTERNET
4913 IWL
4923 MCIX
4926 TELINTAR
4927 ASN-SBCNET
4958 LDSNET
4967 STARTEL
4969 NETACCESS
4995 NETUP
4997 RMCI
4999 SPRINTIPDIAL
5000 IOS-NET
5002 BBSATLGA
5003 INSYNC
5006 MIXNET-NET
5024 BRIDGE
5050 PSC-EXT
5051 KOREAPC
5056 INS-NET-2
5071 WESTEL-1
5076 UNICOM
5081 WINTERLAN
5097 SOFTAWARE
5106 AADS-COLUMBUS
513 CERN-AS
517 XLINK-UKA
52 UCLA
5377 - 5631 RIPE-ASNBLOCK5
542 ARNET
549 ONET-AS
553 BELWUE-AS
559 SWITCH-AS
5641 ABS-NET
5645 JUMP-NET
5646 NN-CNSM
5650 ELIX
5656 ACCESSUS-DOM
5668 CENTURY
5669 U-NET
568 SUMNET-AS
5683 CWI-CORE
5687 AA-NET
5688 PASSPORT
5690 VIANET-NO
5691 MITRE-WASH
5696 GOODNET
5700 IV-NET
5705 SIRIUS
5710 GIA-ASN-1
5713 SAIX-NET
5714 EDS-WEB
5716 CYBERCOM
5727 WORLDNET-0
5737 USW-INTERACT2
5738 SOVER-ASN
5742 CCINET
5752 GREATBASIN
5765 INTERLOG
5769 VIDEOTRON
577 CA-NET-AS
5771 INET-AK
5778 SMATNET-TAC
6 HIS-MULTICS
600 OARNET-AS
603 CANET
6058 NWT-AS
6061 DLI-IBS
6062 NETPLEX
6064 INTERSYS-AS
6066 MFS-ASN
6067 OCTACON-AS
6076 ERINET
6079 EROLS
6081 AISNET
6082 MAI-NET
6089 INTERTECH-LTD
6091 NETA
6095 APK-NET
611 CANET11-AS
6113 GRIDNET
6127 IDSC-RITSEC
6136 NWRAINET
6138 CIOE
6140 IMPSAT-AR
6144 SOUND-ADVICE-LTD
6147 UNIRED
6172 HOME-NET-1
6181 FUSE-NET
6197 BATI-ATL
6203 ISDN-NET
6221 USCYBERSITES
6223 USW-INTERACT3
6225 USW-INTERACT6
6226 USW-INTERACT5
6227 USW-INTERACT4
6241 IGS-GATE
6249 ULTRA-RI
6255 CHANNEL1
6259 ASN-FIBERNET
6261 VISINET
6263 NDIN
6299 TELALINK
6302 PHOENIX
6304 IWAY-ASN1
6308 ALASCOM-MIS
6320 VBC-WEST
6325 ISBENET
6327 SHAWFIBER
6332 TELNOR
6335 NTRNET
6337 HIWAAY
6347 DIAMOND
6350 BAWAVEDC
6354 LYCOS
6356 NERDCNET
6360 UNIVHAWAII
6364 ATLANTIC-NET
6365 I1
6371 AMERICATEL
6373 OPUS1
6391 SPACELAB
6395 DPNET-INTERNET
6401 ECONNECT-ASN
6402 ONECALL
6407 ICAN-ASN
6412 KW
6413 SOCOMM
6423 EASYSTREET-ONLINE
6427 LIGHTNING
6429 RDC-INTERNET
6453 TELEGLOBE-AS
6459 I-2000
6461 ABOVENET
6463 RNS-BIS1
6467 ACSI
6629 NOAA-AS
6630 LOA
668 ASN-ASNET-NET-AS
676 ARNET-AS
679 TUNET-AS
681 KAWAIHIKO-1
684 MBNET-AS
690 NSFNET-T3-RT-AS
701 - 705 ALTERNET-AS
71 HP-INTERNET-AS
715 APPLE-CORPORATE-AS
719 LANLINK-AS
747 TAEGU-AS
760 UNIVIE-AS
762 WELLFLEET-AS
766 IRIS-AS
786 JANET
789 IN2P3-LYON-AS
790 FUUG-NET-AS-AS
803 SASK-NET-AS
81 CONCERT
813 UUNETCA-AS1
814 UUNETCA-AS2
815 UUNETCA-AS3
816 UUNETCA-AS4
856 NBIX4

###############################################

##############################################################

Knodes Index

http://www.fixedorbit.com/metrics.htm

The Knodes Index is the best measurement of a network s connectivity to the Internet.
The Knodes Index is based on a variety of statistics, such as relative size, IP address control and peering arrangements. The index is calculated to indicate the average number of networks, or hops that must be traversed between any IP address on a given network to any other IP address on the Internet.




##############################################################

###########################################################

http://www.caida.org/projects/cisco02autorank/

http://www.pch.net/documents/data/exchange...ep-in-addrs.txt


###########################################################


IN-ADDR.ARPA domain




Reverse Zone / "in-addr.arpa"



PTR-Records (domain name pointer)

#######################################################################

########################################################

DNS Queries


The major task carried out by a DNS server is to respond to queries (questions) from a local or remote resolver or other DNS acting on behalf of a resolver. A query would be something like 'what is the IP address of host=fred in domain=mydomain.com'.

A DNS server may receive such a query for any domain. DNS servers may be configured to be authoritative for some (if any) domains, slaves, caching, forwarding or many other combination. Most of the queries that a DNS server will receive will be for domains for which it has no knowledge i.e for which it has no local zone files. The DNS system allows the name server to respond in different ways to queries about which it has no knowledge.

There are three types of queries defined for DNS:

A recursive query - the real answer to the question is always returned. DNS servers are not required to support recursive queries.
An Iterative (or non-recursive) query - where the real answer MAY be returned. All DNS servers must support Iterative queries.
An Inverse query - where the user wants to know the domain name given a resource record.
Note: The process called Reverse Mapping (returns a host name given an IP address) does not use Inverse queries but instead uses Recursive and Iterative (non-recursive) queries using the special domain name IN-ADDR.ARPA.

Historically reverse IP mapping was not mandatory. Many systems however now use reverse mapping for security and simple authentication schemes so proper implementation and maintenance is now practically essential.



Recursive Queries
A recursive query is one where the DNS server will fully answer the query (or give an error). DNS servers are not required to support recursive queries and both the resolver (or another DNS acting recursively on behalf of another resolver) negotiate use of recursive service using bits in the query headers.

There are three possible responses to a recursive query:

The answer to the query accompanied by any CNAME records (aliases) that may be useful.
An error indicating the domain or host does not exist(NXDOMAIN).
This response may also contain CNAME records that pointed to the non-existing host.
An temporary error indication - e.g. can't access other DNS's due to network error etc..
In a recursive query a DNS server will, on behalf of the client (resolver), chase the trail of DNS across the universe to get the real answer to the question. The journey of a simple query such as 'what is the IP address of a host=fred in domain=mydomain.com' to a DNS server which supports recursive queries but is not authoritative or a slave for mydomain.com could look something like this:

Resolver on a host sends query 'what is the IP address of a host=fred in domain=mydomain.com' to locally configured DNS server.
DNS server looks up mydomain.com in local tables - not present
DNS sends request to a root-server for the IP of a name server for mydomain.com
Using root-server supplied IP, the DNS server sends query 'what is the IP address of a host=fred in domain=mydomain.com' to mydomain.com name server.
Response is a CNAME record which shows fred is aliased to joe.
DNS server sends another query 'what is the IP address of a host=joe in domain=mydomain.com' to authoritative mydomain.com name server.
send response joe=x.x.x.x (with CNAME record fred=joe) to original client resolver.


Iterative (non-recursive) Queries
A Iterative (or non-recursive) query is one where the DNS server may provide a partial answer to the query (or give an error).

DNS servers must support non-recursive queries.

There are four possible responses to a non-recursive query:

The answer to the query accompanied by any CNAME records (aliases) that may be useful.
The response will indicate whether the data is authoritative or cached.
An error indicating the domain or host does not exist(NXDOMAIN).
This response may also contain CNAME records that pointed to the non-existing host.
An temporary error indication - e.g. can't access other DNS's due to network error etc..
A referral (an IP address) of a name server that is closer to the requested domain name.
This may or may not be the authoritative name server.
The journey of a simple query such as 'what is the IP address of a host=fred in domain=mydomain.com' to a DNS server which supports Iterative (non-recursive) queries but is not authoritative or a slave for mydomain.com could look something like this:

Resolver on a host sends query 'what is the IP address of a host=fred in domain=mydomain.com' to locally configured DNS server.
DNS server looks up mydomain.com in local tables - not present
DNS sends request to a root-server for the IP of a name server for mydomain.com
DNS server sends received IP as a referral to the original client resolver.
Resolver sends another query 'what is the IP address of a host=joe in domain=mydomain.com' to referral IP address obtained from DNS server.
Resolver receives a response with a CNAME which shows fred is aliased to joe.
Resolver sends another query 'what is the IP address of a host=joe in domain=mydomain.com' to referral IP address obtained from DNS server.
Resolver gets response joe=x.x.x.x.

Inverse Queries
An Inverse query maps a resource record to a domain.
An example Inverse query would be 'what is the domain name for this MX record'.
Inverse query support is optional and it is permitted from the DNS server to return a response 'Not Implemented'.

Inverse queries are NOT used to find a host name given an IP address.
This process is called Reverse Mapping (Look-up) uses recursive and Iterative (non-recursive) queries with the special domain name IN-ADDR.ARPA.


read more important DNS information here:
- http://techrepublic.com.com/5100-6262-1058014.html
- http://www.zytrax.com/books/dns/ch2/
- http://n3dst4.com/articles/dnsbasics


######################################################################

Hey Moore,

You may not know how much you're appreciated, but I just thought I'd let you know.

You really put alot of effort into providing good info for us, Thanks man!

Mike

P.S. hahaha

Thanks Tozz..

-----------------------------------------------------------------------------------------------------------------


How to Find Information About People on the Web:
http://www.monash.com/people.html


Spam Database IP lookups :
http://www.mail-abuse.com/lookup.html

http://www.senderbase.org/search
http://www.senderbase.org/search?page=senders


OK heres an easy way to find out the ip address or hostname , to block in a firewall or HOSTS file:

put the URL or IP you want to find into this IP search page at Sam Spade : [ do stuff ]
http://www.samspade.org/

eg: 69.20.62.53

69.20.62.53 = [ web1.nictechnetworks.com ]
Server Used: [ whois.arin.net ]

NICTECHNETWORKS.COM = [ 207.36.117.38 ]

207.36.117.38 = [ 207-36-117-38.ptr.primarydns.com ]
OrgName: CyberGate Inc.
OrgID: CYBG
Address: 3250 W. Commercial Blvd. Suite 200
City: Ft. Lauderdale
StateProv: FL
PostalCode: 33309
Country: US
NetRange: 207.36.0.0 - 207.36.255.255
CIDR: 207.36.0.0/16
NetName: GATE-CIDR-2
NetHandle: NET-207-36-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: NS.VALUEWEB.NET
NameServer: NS2.VALUEWEB.NET


Try this one for IP's or URL's as well :

http://www.whois.sc/

http://www.whois.sc/69.20.62.53

OrgName: Rackspace.com
OrgID: RSPC
Address: 112 E. Pecan St.
Address: Suite 600
City: San Antonio
StateProv: TX


please read these too :
http://www.bluetack.co.uk/forums/index.php?showtopic=1329

http://www.bluetack.co.uk/forums/index.php?showtopic=1076

--------------------------------------------------------------------------------

:: THE WEBHELPERS IP TRACKING TIPS FOR HUNTING SPYWARE ::

--------------------------------------------------------------------------------

I use two main utilities in my search for knowledge.

1. Whois View: http://www.whoisview.com/products/whoisview/

This gives me the following:
Who owns a domain name
Who owns a specified IP address block
Who is the web hosting provider for a website
Who provides the DNS, Email handling, etc for a domain

2. Sam Spade 1.14
http://static.samspade.org/ssw/spade114.exe

Allows for ping, trace, whois, plus much more.
The best feature is "View Raw Web site" This lets me put in those URL addresses from search results and also my firewall log entries and it returns only the code to view. This is one way to check a site without using the Browser and you can then see if it looks unsafe to go their.

3. Almost 75% of all baddies register their domains thru Godaddy and you would need to enter an ID in order to get the whois information.

https://registrar.godaddy.com/whois.asp

4. When viewing a whois and you see a state address and they claim they are INC., etc. find the state corporation data base and see if they are really who they are if they registered with that state.

http://www.crimescreen.com/linkspage.htm

5. When looking to see what if any a web sites looked before they changed, use the wayback machine.
http://www.archive.org/

==================================================================

How to find out what IP's a company owns by Deathangel :

http://www.bluetack.co.uk/forums/index.php?showtopic=1067

american = http://www.arin.net
use the search box on the upper right to put in the companys name and follow the name with a * so it will look like this walmart* that will pull up all of there ranges unless they have them misspelled to try to hide them.

they also have a ftp site that has some of the info there in text files you can reach it at
ftp://ftp.arin.net/erx/ and goto the folder called curent and it will take you to the latest dump

euro and such = http://www.ripe.net

ripe will only give you 100 matches but they do have a search now that can be accessed here :

http://ripe.net/db/whois-free.html

that is a limited search but they also have the full database on there ftp server

ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz


asia and au = http://www.apnic.net

apnic has a whois search but their ftp is better

ftp://ftp.apnic.net/public/apnic/whois-data/

this is listed by location
for example AUNIC is austrailia

there are a ton of whois server but that covers the main 3 im working on makeing this a guide for finding out information

after you download the guides its easier to convert them to pdf to search them,
if you open them in notepad or word pad they like to lag

here is a big list but its some what confusing to deal with

http://www.mattsscripts.co.uk/servers.lst

and here isone of the best lists there is

ftp://sipb.mit.edu/pub/whois/whois-servers.list

List of Internet whois servers, 8 March 2000 (Version 4.19)

This list was collected and compiled by Matt Power of M.I.T.

Questions or comments about this list should be sent to the address:

mhpower@mit.edu


Preferred server name Associated institution
---------------------------------------------------------------------
whois.alabanza.com Alabanza, Inc C=US
whois.compuserve.com CompuServe Interactive Services, Inc C=US
whois.discount-domain.com interQ Inc. C=JP
dns411.com Name.Space C=US
whois.domaindiscover.com TierraNet, Inc. C=US
whois.domainpeople.com NetNation Communications Inc. C=CA
whois.easyspace.com EasySpace Ltd. C=GB
whois.enom.com eNom, Inc. C=US
whois.geektools.com CenterGate Research Group, LLC C=US
whois.ibm.com IBM C=US
whois.internetnamesww.com Melbourne IT C=AU
whois.names4ever.com A+Net Registrar C=US
whois.namesecure.com Maaznet Directory Service Inc. C=US
whois.networksolutions.com Network Solutions, Inc. C=US
whois.pacbell.com Pacific Bell C=US
whois.register.com Forman Interactive Corp C=US
whois.registrars.com Internet Domain Registrars C=US
whois.sunquest.com Sunquest Information Systems C=US

whois.berkeley.edu University of California at Berkeley C=US
www.binghamton.edu State University of New York at Binghamton C=US
finger.caltech.edu California Institute of Technology C=US
csufresno.edu California State University - Fresno C=US
csuhayward.edu California State University - Hayward C=US
csus.edu California State University - Sacramento C=US
whois.cwru.edu Case Western Reserve University C=US
cc.fsu.edu Florida State University C=US
directory.gatech.edu Georgia Institute of Technology C=US
gettysburg.edu Gettysburg College C=US
gmu.edu George Mason University C=US
whois.dfci.harvard.edu Dana-Farber Cancer Institute C=US
hmc.edu Harvey Mudd College C=US
indiana.edu Indiana University C=US
nii.isi.edu US Domain Registry C=US
whois.isi.edu .INT Whois Service C=US
whois.messiah.edu Messiah College C=US
whois.rsmas.miami.edu University of Miami, Rosentiel School of Marine and Atmospheric Sciences C=US
mit.edu Massachusetts Institute of Technology C=US
directory.msstate.edu Mississippi State University C=US
vax2.winona.msus.edu Minnesota State University - Winona C=US
info.nau.edu Northern Arizona University C=US
whois.ncsu.edu North Carolina State University C=US
nd.edu University of Notre Dame C=US
earth.njit.edu New Jersey Institute of Technology C=US
vm1.nodak.edu North Dakota State University C=US
austin.onu.edu Ohio Northern University C=US
ph.orst.edu Oregon State University C=US
osu.edu Ohio State University C=US
whois.oxy.edu Occidental College C=US
info.psu.edu Pennsylvania State University C=US
whois.cc.rochester.edu University of Rochester C=US
whitepages.rutgers.edu Rutgers University C=US
whois.sdsu.edu San Diego State University C=US
stanford.edu Stanford University C=US
camis.stanford.edu Stanford University C=US
stjohns.edu St. John's University C=US
sunysb.edu State University of New York, Stony Brook C=US
whois.bcm.tmc.edu Baylor College of Medicine C=US
whois.ubalt.edu University of Baltimore C=US
directory.ucdavis.edu University of California at Davis C=US
uchicago.edu University of Chicago C=US
ucsd.edu University of California at San Diego C=US
weber.ucsd.edu University of California at San Diego, Division of Social Sciences C=US
cgl.ucsf.edu University of California at San Francisco, School of Pharmacy C=US
whois.uh.edu University of Houston C=US
whois.umass.edu University of Massachusetts at Amherst C=US
lookup.umd.edu University of Maryland C=US
umn.edu University of Minnesota C=US
ns.unl.edu University of Nebraska at Lincoln C=US
whois.upenn.edu University of Pennsylvania C=US
x500.utexas.edu University of Texas at Austin C=US
netlib2.cs.utk.edu na-net (linear algebra on computers) C=US
whois.virginia.edu University of Virginia C=US
whois.wfu.edu Wake Forest University C=US
wisc.edu University of Wisconsin C=US
wpi.wpi.edu Worcester Polytechnic Institute C=US
ibc.wustl.edu Washington University C=US

vm1.hqadmin.doe.gov U.S. Department of Energy Headquarters C=US
wp.doe.gov U.S. Department of Energy C=US
llnl.gov Lawrence Livermore National Laboratory C=US
x500.arc.nasa.gov NASA Ames Research Center C=US
x500.gsfc.nasa.gov NASA Goddard Space Flight Center C=US
whois.hq.nasa.gov NASA Headquarters C=US
x500.ivv.nasa.gov NASA Software Independent Verification & Validation Facility C=US
whois.jpl.nasa.gov NASA Jet Propulsion Laboratory C=US
x500.jsc.nasa.gov NASA Johnson Space Center C=US
larc.nasa.gov NASA Langley Research Center C=US
whois.larc.nasa.gov NASA Langley Research Center C=US
x500.msfc.nasa.gov NASA Marshall Space Flight Center C=US
x500.ssc.nasa.gov NASA Stennis Space Center C=US
x500.wstf.nasa.gov NASA White Sands Test Facility C=US
x500.nasa.gov National Aeronautics and Space Administration C=US
wp.nersc.gov National Energy Research Supercomputer Center C=US
whois.nic.gov Center for Email Technology C=US
seda.sandia.gov Sandia National Laboratories C=US

whois.nic.mil DoD Network Information Center C=US
whois.nrl.navy.mil Naval Research Laboratory C=US

whois.6bone.net 6bone Registry C=US
whois.abuse.net Network Abuse Clearinghouse C=US
whois.aco.net Austrian Academic Computer Network C=AT
whois.apnic.net Asia Pacific Network Information Center C=SC
whois.arin.net American Registry for Internet Numbers C=US
whois.aunic.net The .AU Registry C=AU
whois.awregistry.net All West Communications C=US
whois.cary.net CARYNET & HK eDNS Whois server C=HK
whois.corenic.net CORE Internet Council of Registrars C=CH
whois.crsnic.net Network Solutions, Inc. for Shared Registration System C=US
whois.cw.net Cable & Wireless USA C=US
wp.es.net Energy Sciences Network C=US
whois.hinet.net Chunghwa Telecom C=TW
ds.internic.net Network Solutions, Inc. (non-MILNET/non-POC) C=US
whois.internic.net Network Solutions, Inc. C=US
whois.ja.net JANET C=GB
whois.krnic.net Korea Network Information Center C=KR
whois.lac.net Latin America & Caribbean Whois Server C=EC
companies.mci.net RFC 2345 TLD-WHOIS demonstration server C=US
whois.nameit.net nameIT C=US
whois.netnames.net NetNames (.AF, .BT, .PW, .TM) C=GB
whois.nomination.net NomiNation (.GB.COM, .GB.NET, .UK.COM, .UK.NET) C=GB
whois.nsiregistry.net Network Solutions, Inc. C=US
whois.oleane.net OLEANE SA C=FR
whois.opensrs.net Open Shared Registration System C=US
pcdc.net Pacific Communications Development Corp. C=TW
whois.ra.net The Routing Arbiter Project C=US
whois.ripe.net Reseaux IP Europeens C=NL
whois.ripn.net Russian Institute for Public Networks C=RU
whois.thnic.net Thailand Network Information Center C=TH
whois.twnic.net Taiwan Network Information Center C=TW

whois.dhs.org Domain Host Services C=AU
whois.morris.org Morris Automated Information Network C=US

whois.nic.ac nic.ac C=AC
whois.nic.am AM Network Information Centre C=AM
whois.nic.as ASNIC C=AS
wp.tuwien.ac.at Technische Universitat Wien C=AT
whois.risc.uni-linz.ac.at Research Institute for Symbolic Computation, University of Linz C=AT
whois.wu-wien.ac.at Wirtschaftsuniversitaet Wien C=AT
archie.au Australian Academic and Research Network C=AU
whois.connect.com.au Connect.com.au Pty Ltd C=AU
whois.adelaide.edu.au University of Adelaide C=AU
whois.monash.edu.au Monash University C=AU
uwa.edu.au University of Western Australia C=AU
sserve.cc.adfa.oz.au University College, Australian Defense Force Academy C=AU
whois.kuleuven.ac.be Katholieke Universiteit Leuven C=BE
whois.belnet.be Belgian National Research Network C=BE
whois.registro.br registro.br C=BR
whois.camosun.bc.ca Camosun College, Victoria, B.C. C=CA
whois.canet.ca Bell Canada Internet Transit Service C=CA
whois.cdnnet.ca CDNnet C=CA
whois.queensu.ca Queen's University, Kingston, Canada C=CA
ac.nsac.ns.ca Nova Scotia Agricultural College C=CA
whois.unb.ca University of New Brunswick C=CA
panda1.uottawa.ca University of Ottawa C=CA
dvinci.usask.ca University of Saskatchewan, Engineering C=CA
whois.usask.ca University of Saskatchewan C=CA
phys.uvic.ca University of Victoria, Physics & Astronomy C=CA
whois.uwo.ca University of Western Ontario C=CA
whois.nic.cc NIC.CC Registration Services C=CC
whois.nic.ch SWITCH Swiss Academic and Research Network C=CH
whois.nic.ck Cook Islands Network Information Centre C=CK
whois.nic.cl U. de Chile (NIC Chile) C=CL
whois.cnnic.net.cn Computer Network Center, Chinese Academy of Sciences C=CN
whois.ci.ucr.ac.cr University of Costa Rica Computer Center C=CR
whois.cuni.cz Charles University, Prague C=CZ
whois.mff.cuni.cz Charles University, Faculty of Mathematics and Physics C=CZ
www.fce.vutbr.cz Faculty of Civil Engineering, Technical University of Brno C=CZ
gopher.fme.vutbr.cz Faculty of Mechanical Engineering, Technical University of Brno C=CZ
whois.fee.vutbr.cz Faculty of Elec. Eng. and Computer Sci., Technical Univ. of Brno C=CZ
whois.vutbr.cz Technical University of Brno C=CZ
whois.fh-koeln.de Fachhochschule Koeln C=DE
whois.fzi.de Forschungszentrum Informatik C=DE
hermes.informatik.htw-zittau.de HTW Zittau/Goerlitz Elektrotechnik/Informatik C=DE
whois.nic.de DEutsches Network Information Center C=DE
whois.th-darmstadt.de Darmstadt University of Technology C=DE
whois.tu-chemnitz.de Technische Universitaet Chemnitz C=DE
whois.uni-regensburg.de Universitaet Regensburg C=DE
whois.uni-c.dk Danish Computing Centre for Research and Education C=DK
whois.ut.ee University of Tartu C=EE
whois.eunet.es EUnet, Goya, Spain C=ES
whois.dit.upm.es Tech. Univ. Madrid, Telecommunications Highschool C=ES
cs.hut.fi Helsinki University of Technology C=FI
oulu.fi Oulu University C=FI
vtt.fi Technical Research Centre of Finland C=FI
whois.nic.fr Association Francaise pour le Nommage Internet en Cooperation C=FR
whois.nordnet.fr NordNet C=FR
whois.univ-lille1.fr University of Sciences and Technologies of Lille - France C=FR
whois.hknic.net.hk HKNIC C=HK
whois.registry.hm HM Domain Registry C=HM
whois.iisc.ernet.in Indian Institute of Science C=IN
whois.ncst.ernet.in National Centre for Software Technology C=IN
isgate.is Association of Research Networks in Iceland C=IS
isgate3.isnet.is Internet a Islandi C=IS
pgebrehiwot.iat.cnr.it Nigerian TLD Registration Service C=NG
dsa.nis.garr.it GARR-NIS c/o CNR-CNUCE C=IT
whois.nic.it Italian Network Information Center C=IT
whois.nic.mx Network Information Center - Mexico C=MX
whois.aist-nara.ac.jp Nara Institute of Science and Technology C=JP
whois-server.l.chiba-u.ac.jp Chiba University C=JP
whois.hiroshima-u.ac.jp Hiroshima University C=JP
gopher.educ.cc.keio.ac.jp Science and Technology Computing Center, Keio University C=JP
whois.cc.keio.ac.jp Keio University C=JP
whois.cc.uec.ac.jp University of Electro-Communications C=JP
whois.yamanashi.ac.jp Yamanashi University C=JP
whois.nic.ad.jp Japan Network Information Center C=JP
www.orions.ad.jp Osaka Regional Information and Open Network Systems C=JP
whois.domain.kg Kyrgyzstan TLD C=KZ
sorak.kaist.ac.kr Korea Advanced Institute of Science & Technology C=KR
whois.nic.or.kr Korea Network Information Center C=KR
whois.domain.kz Kazahstan Domain Name Registry C=KZ
whois.nic.li SWITCH Swiss Academic and Research Network C=LI
whois.nic.lk Sri Lanka Domain Registry C=LK
www.restena.lu RESTENA C=LU
whois.nic.mm MM-NIC C=MM
www.nic.mx NIC-Mexico C=MX
condor.dgsca.unam.mx Univ. Nacional Autonoma de Mexico, D.G. de Servicios de Computo Academico C=MX
domain-registry.nl Stichting Internet Domeinregistratie Nederland C=NL
whois.norid.no UNINETT FAS (NORID) C=NO
whois.nic.nu .NU Domain Ltd C=NU
whois.canterbury.ac.nz University of Canterbury C=NZ
directory.vuw.ac.nz Victoria University, Wellington C=NZ
waikato.ac.nz Waikato University C=NZ
whois.patho.gen.nz PATHOGEN C=NZ
whois.domainz.net.nz Domainz -- The New Zealand Internet Registry Ltd C=NZ
whois.rcp.net.pe Red Cientifica Peruana C=PE
whois.icm.edu.pl Interdyscyplinarne Centrum Modelowania Matematycznego i Komputero C=PL
whois.elka.pw.edu.pl Faculty of Electronic Engineering, Warsaw University of Technology C=PL
whois.ia.pw.edu.pl Institute of Automatic Control, Warsaw University of Technology C=PL
whois.dns.pt Fundacao para a Computacao Cientifica Nacional C=PT
dsa.fccn.pt Fundacao para a Computacao Cientifica Nacional C=PT
chalmers.se Chalmers University of Technology C=SE
kth.se Royal Institute of Technology C=SE
whois.nic-se.se Network Information Centre Sweden C=SE
sics.se Swedish Institute of Computer Science C=SE
whois.nic.net.sg Singapore Network Information Centre C=SG
whois.nic.sh NIC.SH Domain Registry C=SH
whois.uakom.sk SANET (WAN of Slovak academic institutions) C=SK
whois.nic.st Domain Council of Sao Tome and Principe C=ST
whois.adamsnames.tc AdamsNames (.GS, .MS, .TC, .TF, .VG) C=TC
whois.nic.tj TJ-NIC C=TJ
whois.tonic.to Tonic Domain Name Registry C=TO
whois.metu.edu.tr Middle East Technical University C=TR
whois.seed.net.tw Seednet C=TW
whois.iii.org.tw Institution for Information Industry C=TW
src.doc.ic.ac.uk Imperial College C=GB
whois.lut.ac.uk Loughborough University C=GB
whois.nic.uk Nominet UK (.UK Domain Registrar) C=GB
dsa.shu.ac.uk Sheffield Hallam University C=GB
whois.state.ct.us Department of Administrative Services, State of Connecticut C=US
info.cnri.reston.va.us Corporation for National Research Initiatives, Knowbot interface C=US
whois.frd.ac.za National Research Foundation C=ZA
whois.und.ac.za University of Natal (Durban) C=ZA
whois.co.za Foundation for Research Development C=ZA

--------------------------------------------------------------------------------

"Documentation", and other comments...


Redistribution
--------------
If you redistribute this list, or excerpt a significant number of
entries from it, be sure to also pass along the original anonymous-FTP
location, and request that updates be sent to my e-mail address, as
specified at the top of this file. This will allow users to obtain
updated versions at a later time, and will help ensure that I get the
information I need to do the updating.

Also, keep in mind that accessing a whois server requires a direct
connection to the Internet. In general, sites that have access to the
Internet via tcp/whois will also have access to the Internet via
tcp/ftp, and will thus be able to obtain this file directly. Making
the file available via a mail-based server is therefore largely
unnecessary.


Updates
-------
I am interested in any corrections to the above listing, and in
reports of other whois servers. Please send them via e-mail to the
address listed at the top of this file. Unless the maintainer of the
server has already announced his whois service publicly, I will
attempt to contact the postmaster or system maintainer prior to
including a new entry.


Scope
-----
Whois servers, at least by my definition, provide directory
information in response to TCP queries on port 43, in a manner roughly
analogous to the DDN NIC whois service described in RFC 954. I realize
that many sites instead provide this directory service via the finger
protocol, or accept queries by mail for directory information.
Although I'd be happy to receive reports of these, the scope of this
particular listing is limited to the TCP whois service.

There are a few hosts that accept tcp/whois connections, but respond
with information identical to that given by a standard finger server.
Since I don't consider this a directory service, I have been omitting
these hosts.


Unlisted servers
----------------
I know of some other whois servers that aren't listed above (at their
maintainers' requests), even though they allow access to at least a
small amount of directory information. Currently, this includes
twenty-two in North America, six in Europe, and one in Asia. Typical
reasons include: service is about to be shut down, service is still
being developed and will be announced later, or another server
provides the same data in a better supported manner.


Server names
------------
There are currently three popular naming conventions for whois
servers. The most common practice is to put whois service on a host
as far up as possible in the organization's domain hierarchy. For
example, the highest-level domain name associated with M.I.T. is
MIT.EDU, and M.I.T.'s whois service is operated on the host named
mit.edu.

Another common practice is to choose 'whois' or 'wp' as the first part
of the domain name ('wp' stands for "White Pages"). This would be the
case if M.I.T.'s whois service were on a host named whois.mit.edu or
wp.mit.edu. In these cases, the listed name is often an alias, not the
host's canonical name. In selecting the name to be listed, I've given
preference to aliases starting with whois or wp.

I personally prefer the first-mentioned convention, since it results
in shorter command lines, and ones I believe are less confusing to
beginning Internet users. In particular, the top-level host often
supports organization-wide mail service, and thus the same host name
can be used for whois queries and for e-mail.


Usage
-----
The most common access approach involves separately querying each
server of interest, via a direct tcp/whois connection. However, there
are currently a number of active projects concerned with improved
interfaces to these servers, either by more intelligent client
software, or by standardization of the server behavior. Eventually,
this should eliminate the need for end users to have the complete
collection of server names; at this point, though, distributing the
server list to individual Internet users is still worthwhile.

The procedure for accessing the whois servers will vary depending on
your host's operating system, and on what software is installed. On
UNIX systems, the preferred method is

whois -h _server_name_ _name_of_person_

If there is no whois program, sometimes it will work to type

telnet _server_name_ 43

and then type the "name of person" on a separate line. (The usefulness
of this will vary depending on the details of the telnet client
implementation installed on your system.)

Alternatively, you may be able to compile a whois program yourself,
starting from source code available at various anonymous FTP sites. As
a start, you might try searching archie for files named 'whois.tar.Z'.

Programs named 'whois' and 'telnet' may also be available on VMS
systems. Typing 'HELP WHOIS' or 'HELP TELNET' at the DCL prompt may be
useful.

Whois programs may also be installed on other operating systems, or
may be available for these systems via anonymous FTP. Searching archie
for file names matching 'whois' (case insensitive) might be worthwhile.

Also, system administrators interested in starting new whois servers
will probably be able to find one or more separate source-code
packages on anonymous FTP sites. In addition to checking archie, you
may wish to look in the file whois-servers.source, available at the
anonymous-FTP location listed at the top of this file.


Other Formats of This List
--------------------------
Whenever this whois-servers.list file is updated, it is automatically
converted to a few other formats. One that might be of common interest
is a "Summary" version that contains just the server names and
locations, one per line, and a few comment lines that each begin with
';'. This version can be obtained via

whois -h sipb.mit.edu whois-servers

or from a few replication sites that can be found by doing

whois -h sipb.mit.edu whois-list-servers

It's intended mainly for people who have a program to copy the server
list occasionally (e.g., once a week) for local redistribution. If
you're able to redistribute via whois (i.e., by supporting the query
whois -h _your_server_name_ whois-servers), please let me know and
I'll add you to the list of replication sites.


Gopher Access
-------------
The data in this list are also available via the Internet Gopher
system. Gopher clients should connect to the host sipb.mit.edu, port
70, and choose the selection "Internet whois servers". The
whois-server entries accessible in the sipb.mit.edu Gopher server are
automatically updated whenever this file is changed.

Alternatively, one can access this same Gopher menu by connecting to a
root Gopher server at the University of Minnesota and selecting
"Phone Books" then "WHOIS Searches".


AFS Access
----------
Sites using Transarc's AFS (Andrew File System) software can access
the whois-servers.list file using the AFS global name space pathname

/afs/sipb.mit.edu/project/gopher-links/whois-servers.list

(i.e., it is in the directory project/gopher-links relative to
root.cell for the sipb.mit.edu cell.)


Access Restrictions
-------------------
In general, these servers should only be used for isolated queries
about specific individuals of interest. Typically, it is not
acceptable to make an extended series of queries in an attempt to
obtain large sections, or the entirety, of the directory. Such a
strategy is objectionable both because of excessive consumption of
server resources, and because the directory itself is usually
considered proprietary. In particular, deriving lists of persons for
distribution of commercial advertisements or solicitations is
expressly prohibited by site policies in many cases, and could easily
cause sites to curtail the current open access to their whois servers.


Server problems
---------------
Not all of the whois-server entries constitute a "supported" service
within their respective domains. Even at sites where the service is
supported, there may be occasional changes in the server host name.
Also, at any given time, you will probably find one or more of the
servers not operational, or apparently unusable. I have not
purposefully included any servers that I believe have been permanently
shut down. In all cases, either I have personally seen the server
provide useful information within the last few months, or else the
maintainers of the server have asked me to include it anyway, while
they work on resolving usage problems.


Collection
----------
The list was collected primarily via an active resource-discovery
approach involving polling selected Internet hosts for possible
support of tcp/whois service. This was done with some attention to
minimizing consumption of resources on other Internet hosts and
networks. In particular, no DNS zone transfers were used to generate
lists of polling candidates. Instead, a small number of host names in
most second-level domains were selected, using various heuristics, and
whois queries were attempted to each of these. All queries originated
from hosts in the MIT.EDU domain. Also, I've been maintaining versions
of this list since August 1990, and since then a number of persons
have mailed me reports of new whois servers, or updates on the servers
already listed here.

##########################################################################