2

I'm reviewing some apache logs, specifically with respect to downloaded files. I'm interested in knowing, if possible, which domain is responsible for the download, given an IP address.

I've given nslookup a try and it seems to (mostly) get the job done but it returns all sorts of extraneous information. Ideally, I pass in an IP and receive a domain back.

Before I write a shell script to parse the output of nslookup to capture the domain, I'd like to know if this is the best way of approaching this problem, or if there is a more tried-and-true method of doing this.

Specifically, I'd like to know if an address resolves to an amazonaws.com domain. I understand that this might be difficult because EC2 machines are dynamically created and destroyed - I'd like to know if the IP addresses for AWS/EC2/EMR machines fit any sort of addressing pattern.

3 Answers 3

1

Here are the IP ranges owned by Amazon for EC2.

https://forums.aws.amazon.com/ann.jspa?annID=857

2
  • This is exactly what I'm looking for. How good is Amazon at keeping this information up-to-date? Dec 31, 2010 at 12:18
  • It is from a sticky in their forums. The 50.16/16 block is fairly new, so I am guessing at least weekly
    – Flashman
    Jan 4, 2011 at 18:12
2
$ host 173.242.113.231

This will only work if there is a PTR record for that domain though.

5
  • In that case, to only retrieve the domain, would it be as simple as "host x.x.y.y | awk '{print $5}'" ? Are there any exceptions or other cases? Dec 29, 2010 at 12:43
  • Yep, that's right. Trim the trailing '.' though.
    – atx
    Dec 29, 2010 at 12:59
  • 1
    or dig -x x.y.z.a and you'll get the reverse dns lookup for it. Not infallible, relies on the PTR existing. Dec 29, 2010 at 13:01
  • You can also whois and IP address, and get some info on who owns it, what the AS is, etc. Quite interesting. TeamCymru (team-cymru.org/Services/ip-to-asn.html) have a nice tool for doing this a bit more programatically. Dec 29, 2010 at 13:01
  • Tom O'Connor has a much better way than using `host'.
    – atx
    Dec 29, 2010 at 13:04
1

Not all IPs will have PTR records. If you're looking for what "entity" owns the IP you may also want to check Whois. You're not going to reach 100% on this because of NAT, Virtualization, Hosting, ISPs etc... I may access your site from example.com, but the IP used will just resolve to host.genericISP.com

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .