Find the Owner of a Network

Track down network contacts using WHOIS databases.

Looking through your IDS logs, you’ve seen some strange traffic coming from another network across the Internet. When you look up the IP address in DNS, it resolves as something like Who do you contact to help track down the person who sent this traffic? You’re probably already aware that you can use the whois command to find out contact information for owners of Internet domain names. If you haven’t used whois, it’s as simple as typing, well, “whois”:

$ whois
   Dewey Cheatum

   Registered through:

   Domain servers in listed order:
   For complete domain details go to:

Unfortunately, this whois entry isn’t as helpful as it might be. Normally, administrative and technical contacts are listed, complete with a phone number and email and snail mail addresses. Evidently, has a policy of releasing this information only through their web interface, apparently to cut down on spam harvesters. But if the registrant’s name is listed as “Dewey Cheatum,” how accurate do you think the rest of this domain record is likely to be? Although domain registrants are “required” to give legitimate information when setting up a domain, I can tell you from experience that using whois in this way is a great tool for tracking down honest people.

Since ...

Get Network Security Hacks now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.