network
I ran across a really neat way to use the whois tool in Linux the other day. There is apparently a lot more information available than I knew about! Check out the full article for more.
Basically, in addition to the normal owner/tech contact data that you can get from the standard whois servers, and the IP block assignment information you can get from ARIN, there’s also some additional IP information you can get from Cymru. Specifically, you can run queries against ‘whois.cymru.com’ to determine what ISP hosts/owns the netblock. Check it out :
[user@localhost ~]$ whois -h whois.cymru.com 204.10.167.1
[Querying whois.cymru.com]
[whois.cymru.com]
AS | IP | AS Name33241 | 204.10.167.1 | EMCS-AS – Endless Mountain Cyb
In addition to that, you can also check another server, ‘v4-peer.whois.cymru.com’ to check for upstream peers. Extremely useful for determining how “connected” a provider is when you’re looking for new service. Or, for determining what providers you need to talk to for help in blocking possible attacks. Check it out :
[user@localhost ~]$ whois -h v4-peer.whois.cymru.com 204.10.167.1
[Querying v4-peer.whois.cymru.com]
[v4-peer.whois.cymru.com]
PEER_AS | IP | AS Name
3593 | 204.10.167.1 | EPIX – EPIX
3737 | 204.10.167.1 | PTD-AS – PenTeleData Inc.
Overall, I find this to be quite useful and I’ll definitely be using it! I hope you find it just as useful…