up vote 2 down vote favorite
share [g+] share [fb]

I'm reviewing some apache logs, specifically with respect to downloaded files. I'm interested in knowing, if possible, which domain is responsible for the download, given an IP address.

I've given nslookup a try and it seems to (mostly) get the job done but it returns all sorts of extraneous information. Ideally, I pass in an IP and receive a domain back.

Before I write a shell script to parse the output of nslookup to capture the domain, I'd like to know if this is the best way of approaching this problem, or if there is a more tried-and-true method of doing this.

Specifically, I'd like to know if an address resolves to an amazonaws.com domain. I understand that this might be difficult because EC2 machines are dynamically created and destroyed - I'd like to know if the IP addresses for AWS/EC2/EMR machines fit any sort of addressing pattern.

link|improve this question
feedback

3 Answers

up vote 1 down vote accepted

Here are the IP ranges owned by Amazon for EC2.

https://forums.aws.amazon.com/ann.jspa?annID=857

link|improve this answer
This is exactly what I'm looking for. How good is Amazon at keeping this information up-to-date? – Neil Kodner Dec 31 '10 at 12:18
It is from a sticky in their forums. The 50.16/16 block is fairly new, so I am guessing at least weekly – Flashman Jan 4 '11 at 18:12
feedback
up vote 2 down vote 
$ host 173.242.113.231

This will only work if there is a PTR record for that domain though.

link|improve this answer
In that case, to only retrieve the domain, would it be as simple as "host x.x.y.y | awk '{print $5}'" ? Are there any exceptions or other cases? – Neil Kodner Dec 29 '10 at 12:43
Yep, that's right. Trim the trailing '.' though. – malfy Dec 29 '10 at 12:59
1  
or dig -x x.y.z.a and you'll get the reverse dns lookup for it. Not infallible, relies on the PTR existing. – Tom O'Connor Dec 29 '10 at 13:01
You can also whois and IP address, and get some info on who owns it, what the AS is, etc. Quite interesting. TeamCymru (team-cymru.org/Services/ip-to-asn.html) have a nice tool for doing this a bit more programatically. – Tom O'Connor Dec 29 '10 at 13:01
Tom O'Connor has a much better way than using `host'. – malfy Dec 29 '10 at 13:04
feedback
up vote 1 down vote

Not all IPs will have PTR records. If you're looking for what "entity" owns the IP you may also want to check Whois. You're not going to reach 100% on this because of NAT, Virtualization, Hosting, ISPs etc... I may access your site from example.com, but the IP used will just resolve to host.genericISP.com

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.