Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If you wanted to trace an IP address because that IP Address was the source of attacks and abuse, how would you accomplish this? Is there anything one can do to find who is using a given IP address and furthermore is there anything that can be done to stop it?

Update: The destination (where the server is) is in the USA. The source indicates that it is also USA but like someone suggested, the IP Address is likely spoofed... I'm still open to further input/details...

Thanks,
Frank

share|improve this question
1  
Good question - filing useful abuse reports is a Very Good Thing to Do. Often the "attacker" will be a malware-infected PC and the person running the source network won't even know there's a problem -- until you tell them, via an abuse report. –  Ben Dunlap Jun 18 '09 at 23:58
add comment

7 Answers

If you've got a non-Windows machine, whois <ip> is your first step. This will tie the IP to a network and possibly even supply you with an 'abuse' contact, usually an email address. You can email an abuse report there. You can also try nslookup <ip> to get a domain name, and look that up on abuse.net.

If you're running Windows start with ARIN's web whois. That may lead you to another web whois service if the IP address is not located in the USA.

share|improve this answer
    
yes regarding the abuse, be sure to log a UTC time that you saw that particular ip address active so they can trace dhcp lease times if possible –  Brendan Jun 19 '09 at 3:17
add comment

The ISP that owns the IP is the only group that really know the identity of the person registered to an IP. The best info you can hope for is what you can get from dnsstuff.

If the matter is serious and you want something done about it, then your only option would be to report it to the police.

You could drop everything from that IP address in your firewall, which might help for a little while, but chances are if they are a decent cracker, they will be bouncing through proxies, and will just come in from a different angle.

If they are just probing for information, don't worry too much. Make sure your applications are OS are patched. If it is something more malicious like a DDoS attack, then there are firewalls that are able to stop them, I'm not familiar with them myself though. If they have already got in, then do a search here. I saw something a couple of days ago about how to recover from an intrusion.

share|improve this answer
2  
I would hold off on talking to law enforcement until I was really sure this was a targeted attack. Much malicious activity online is automated and comes from Uncle Bill's infected home PC. –  Ben Dunlap Jun 19 '09 at 0:21
add comment

Depending on the attack, (DoS, certain port scans, etc), the IP Address will most likely be spoofed. And, as others have already stated, even if you do get a valid (non-spoofed) IP, most likely the end host is a compromised machine that is being used as a stepping stone/ relay.

Also, never "hack-back" This is unethical, most likely illegal where you live, and doesn't help the situation in the least.

Anapologetos

share|improve this answer
    
Thank you for the thoughtful reply. –  Frank V Jun 19 '09 at 16:03
add comment

First step - use WHOIS to find out where the offending IP is; that'll get you a country, ISP/registrar, or even a business address, if you're lucky.

share|improve this answer
add comment

To stop attacks, just firewall the IP address as far "upstream" in your network as you can (at your border). To track down the "user" of an IP address, I generally use:

  • dig -x <IP> to get an idea of what the IP address might be (DSL, dialup, dynamic vs static IP, or even an honest-to-goodness colo box);
  • whois <IP> to find out who the responsible entity is for the netblock (should contain contact details if you want to report the abuse and try to get it stopped at it's source)
  • One thing I never do is use nmap on an IP address to get an idea of the OS and services running on the machine to see if I can remotely access it or crash it to stop the abuse. That would be naughty.
share|improve this answer
    
"That would be naughty". Yes, particularly if the "attacker" is malware running on someone's grandmother's infected home PC -- which is very likely. –  Ben Dunlap Jun 18 '09 at 23:55
    
That's why I never do it. –  womble Jun 19 '09 at 0:01
add comment

When tracking bad stuff back to it's source I always start with a web based whois lookup. I don't want any queries that appear to come from my address block going anywhere near the attack. My favorite is Network Solutions lookup: http://www.networksolutions.com/whois/index.jsp, and then I work back through the providers as appropriate to find the ISP that owns the address.

What next steps you take are really dependent on the type of attacks/abuse you're seeing. You could block attacks at your border, cut off the user's account (if they have one with you), you could email the ISP's abuse line and provide them data on the attacks (times, netflows, etc.) and let them cut them off, and in cases of criminal activity you could call the police.

I think it's worth pointing out here that in cases where you think you might call the cops, if the ISP is across state lines the FBI won't really be interested unless there is SIGNIFICANT financial losses. If you're dealing within a state, incidents like stalking or kiddie porn can be taken to the local police though.

share|improve this answer
add comment

Backtrace works fairly well for a quick and dirty backtrace. However, the IP it returns might not always be the attacker's IP. With botnets, proxies, etc it is getting easier to hide your location.

share|improve this answer
1  
The IP address you get for connected TCP streams is the direct attacker, although it almost certainly isn't the IP address of the person organising the attack. –  womble Jun 18 '09 at 23:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.