Hello,

I wonder how to get a list of the ip´s in the internet.
I mean, if I see a ip xxx.yyy.123.zzz this c-class must be
belonging to a provider, company etc. I think it should be possible to see that ip soandso belongs to an access provider or is a server. Or not yet assigned.

joachim

There are three classes of IP addresses that an organization can receive from the American Registry for Internet Numbers (ARIN) (or the organization's ISP). They are Class A, B, and C. ARIN now reserves Class A addresses for governments throughout the world (although a few large companies, such as Hewlett Packard, have received one in the past) and Class B addresses for medium-sized companies. All other requestors are issued Class C addresses.

Class A

When written in a binary format, the first (leftmost) bit of a Class A address is always 0. An example of a Class A IP address is 124.95.44.15. The first octet, 124, identifies the network number assigned by ARIN. The internal administrators of the network assign the remaining 24 bits. An easy way to recognize whether a device is part of a Class A network is to look at the first octet of its IP address, which will range from 0-126. (127 does start with a 0 bit, but has been reserved for special purposes.)

All Class A IP addresses use only the first 8 bits to identify the network part of the address. The remaining three octets can be used for the host portion of the address. Every network that uses a Class A IP address can have assigned up to 2 to-the-power of 24 (224) (minus 2), or 16,777,214, possible IP addresses to devices that are attached to its network.

Class B

The first 2 bits of a Class B address are always 10 (one and zero). An example of a Class B IP address is 151.10.13.28. The first two octets identify the network number assigned by ARIN. The internal administrators of the network assign the remaining 16 bits. An easy way to recognize whether a device is part of a Class B network is to look at the first octet of its IP address. Class B IP addresses always have values ranging from 128 to 191 in their first octet.

All Class B IP addresses use the first 16 bits to identify the network part of the address. The two remaining octets of the IP address can be used for the host portion of the address. Every network that uses a Class B IP address can have assigned up to 2 to-the-power of 16 (216) (minus 2 again!), or 65,534, possible IP addresses to devices that are attached to its network.

Class C

The first 3 bits of a Class C address are always 110 (one, one and zero). An example of a Class C IP address is 201.110.213.28. The first three octets identify the network number assigned by ARIN. The internal administrators of the network assign the remaining 8 bits . An easy way to recognize whether a device is part of a Class C network is to look at the first octet of its IP address. Class C IP addresses always have values ranging from 192 to 223 in their first octet.

All Class C IP addresses use the first 24 bits to identify the network part of the address. Only the last octet of a Class C IP address can be used for the host portion of the address. Every network that uses a Class C IP address can have assigned up to 28 (minus 2), or 254, possible IP addresses to devices that are attached to its network.

Thanks for your interesting answer.
But, my question was if I see an ip, how can I determine who is the owner of the ip? For example, somebody accesses my pc and my firewall shows an ip. Via tracert I can see, it is a dial-in ip from a certain provider. Or, I cannot see.
tracert to an ip.
Routenverfolgung zu 80-25-214-252.uc.nombres.ttd.es [80.25.214.252

Who belongs to 80.25.214.111 to 254 ?


joachim

http://www.samspade.org/t/ipwhois?a=xxx.xxx.xxx.xxx

thanks a lot. So I just saw somebody from korea
was pinging my pc. Very funny ( or maybe not funny )


that was I was looking for.

Joachim

If you have a late version of whois, it will do a reverse lookup and tell you what you want to know. I have version 4.5.24, which is later that any Red Hat rpms, so I uninstalled the Red Hat whois and downloaded the tarball and compiled from there - works much better.

And yes, it's a jungle out there. If all you got was a ping from Korea consider yourself lucky. I get very regular port scans (the latest fad is port 1433 - about 20 today alone), ftp scans, ssh scans, mail bombs, and at least one DOS - all from Korea, with a smattering from China and a few other countries.

Originally posted by jimroe
If you have a late version of whois, it will do a reverse lookup and tell you what you want to know. I have version 4.5.24, which is later that any Red Hat rpms, so I uninstalled the Red Hat whois and downloaded the tarball and compiled from there - works much better.


What do you mean by reverse lookup? Owner of an IP?

well, I have a w2k pc at home with zonealarm installed. my servers running redhat were attacked twice and hacked two times, also some debian routers we have at customers.
it could be interesting to see where it comes from.
Trying to contact an access provider seems to similar as to carry water into the ocean......



Joachim

RIN now reserves Class A addresses for governments throughout the world Really, when did they start doing that. I know someone who just got space in Class A space and I don't think they are a gov agency (unless they are a secret organization :))

Here is an example of a whois lookup on a recent scan - best way to answer your question about what data is generated:

[root@XXX root]# whois --version
Version 4.5.24.

[root@XXX root]# whois 211.104.167.20
Korea Internet Information Service V1.0 ( created by KRNIC, 2001.6 )

query: 211.104.167.20

# KOREAN

<snip>

ck.kornet.net[/email]

# ENGLISH

IP Address : 211.104.167.16-211.104.167.23
Network Name : KORNET-XDSL-FIXIP-YOUNAMHEE
Connect ISP Name : KORNET
Connect Date : 20010109
Registration Date : 20010524

[ Organization Information ]
Orgnization ID : ORG212354
Org Name : YouNamHee
State : SEOUL
Address : 1CHEUNG 27HO 60BEONJI KASANDONG KEUMCHEONKU
Zip Code : 153-023

[ Admin Contact Information]
Name : Namhee You
Org Name : YouNamHee
State : SEOUL
Address : 1CHEUNG 27HO 60BEONJI KASANDONG KEUMCHEONKU
Zip Code : 153-023
Phone : +82-2-3281-7172
E-Mail : guro3@soback.kornet.net

[ Technical Contact Information ]
Name : Namhee You
Org Name : YouNamHee
State : SEOUL
Address : 1CHEUNG 27HO 60BEONJI KASANDONG KEUMCHEONKU
Zip Code : 153-023
Phone : +82-2-3281-7172
E-Mail : guro3@soback.kornet.net

[root@XXX root]#

Originally posted by RackMy.com
Really, when did they start doing that. I know someone who just got space in Class A space and I don't think they are a gov agency (unless they are a secret organization :))

RackMy.com,

I think he means assigning the whole class A IP block to gov agency....

u mentioned someone u know "who just got space in class A space"...did u mean as in a whole class A or IP addresses in a class A block which has already been assigned??