Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm reviewing some apache logs, specifically with respect to downloaded files. I'm interested in knowing, if possible, which domain is responsible for the download, given an IP address.

I've given nslookup a try and it seems to (mostly) get the job done but it returns all sorts of extraneous information. Ideally, I pass in an IP and receive a domain back.

Before I write a shell script to parse the output of nslookup to capture the domain, I'd like to know if this is the best way of approaching this problem, or if there is a more tried-and-true method of doing this.

Specifically, I'd like to know if an address resolves to an amazonaws.com domain. I understand that this might be difficult because EC2 machines are dynamically created and destroyed - I'd like to know if the IP addresses for AWS/EC2/EMR machines fit any sort of addressing pattern.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

Here are the IP ranges owned by Amazon for EC2.

https://forums.aws.amazon.com/ann.jspa?annID=857

share|improve this answer
    
This is exactly what I'm looking for. How good is Amazon at keeping this information up-to-date? –  Neil Kodner Dec 31 '10 at 12:18
    
It is from a sticky in their forums. The 50.16/16 block is fairly new, so I am guessing at least weekly –  Flashman Jan 4 '11 at 18:12

Not all IPs will have PTR records. If you're looking for what "entity" owns the IP you may also want to check Whois. You're not going to reach 100% on this because of NAT, Virtualization, Hosting, ISPs etc... I may access your site from example.com, but the IP used will just resolve to host.genericISP.com

share|improve this answer
$ host 173.242.113.231

This will only work if there is a PTR record for that domain though.

share|improve this answer
    
In that case, to only retrieve the domain, would it be as simple as "host x.x.y.y | awk '{print $5}'" ? Are there any exceptions or other cases? –  Neil Kodner Dec 29 '10 at 12:43
    
Yep, that's right. Trim the trailing '.' though. –  atx Dec 29 '10 at 12:59
1  
or dig -x x.y.z.a and you'll get the reverse dns lookup for it. Not infallible, relies on the PTR existing. –  Tom O'Connor Dec 29 '10 at 13:01
    
You can also whois and IP address, and get some info on who owns it, what the AS is, etc. Quite interesting. TeamCymru (team-cymru.org/Services/ip-to-asn.html) have a nice tool for doing this a bit more programatically. –  Tom O'Connor Dec 29 '10 at 13:01
    
Tom O'Connor has a much better way than using `host'. –  atx Dec 29 '10 at 13:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.