Informitive Reverse IP Lookups

Dev Shed Forums Sponsor:

October 13th, 2003, 12:49 PM

Burkos

Junior Member

Join Date: Mar 2003

Location: Boston

Posts: 3

Time spent in forums: < 1 sec
Reputation Power: 0

Informitive Reverse IP Lookups

I'm trying to figure out and present to Marketing a report of everybody that has been going to my compnay's web site. I've been doing reverse lookups on IPs, but a significant majority of lookups get stopped at the visitor's hosting company.

Is there a way to probe beyond ISPs and TeleComs? Is there some automated tool, registery, or database out there that has deeper information? Or, do hosting companies actually value and protect their clients privacy, and my task is futile?

Thank you,
Burkos

October 13th, 2003, 03:20 PM

dag-otto

Junior Member

Join Date: Oct 2003

Location: Ottawa,Canada

Posts: 28

Time spent in forums: < 1 sec
Reputation Power: 0

I have seen batch cmd tools like nsbatch and others. That will essentially map 1-254 of each subnet. Reverse zones work similar to forward zones, and are delegated and or hosted to each isp or ip/ip block space holder. In some cases it's not even used. When it is used it's often outdated or may not match the A record. Having fake ptr records is a growing trend now-a-days. Most ISP's infact are using the ip in - dash format as the reverse so it's not to informative. host-192-168-1-12.isp.co.uk. At least it will tell you where the client is coming from. Uk.

You can also try to manually find the answer using dig.
This way you can figure out who the authorative name server is for the reverse zone from the soa.

Code:

int-cache# dig -x 139.134.4.x
; <<>> DiG 8.3 <<>> -x 
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUERY SECTION:
;;      x.4.134.139.in-addr.arpa, type = ANY, class = IN

;; AUTHORITY SECTION:
134.139.in-addr.arpa.   1D IN SOA       sy-dns01.tmns.net.au. dvm.onaustralia.com.au. (
                                        2002020502      ; serial
                                        1H              ; refresh
                                        30M             ; retry
                                        4w2d            ; expiry
                                        1D )            ; minimum


;; Total query time: 383 msec
;; FROM: int-cache.mhweb.internal to SERVER: default -- 192.168.1.8;; WHEN: Mon Oct 13 04:20:23 2003
;; MSG SIZE  sent: 42  rcvd: 118

Hope that helps
Cheers

Viewing: Dev Shed Forums > System Administration > DNS > Informitive Reverse IP Lookups

« Previous Thread | Next Thread »

Thread Tools	Search this Thread
Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts vB code is On Smilies are On [IMG] code is On HTML code is Off

View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox

Forum Jump