[ale] IP ?

[Russell Enderby]

Well if you have an ip lets say 209.251.139.x, I would try a nslookup on
the beginning of the class C.  Try nslookup on 209.251.139.1 - .10 , most
likely the owner of the class C will have some of them registered in a dns
server.

If you really want to crack down, I would try to contact arin and find out
who owns that class C, then go through the companies one by one on who they
re-sold that block of IP's to until you get to the right one.

Russell

Jonathan wrote:

> I run NTOP on our LAN. This LAN is part of a WAN that is firewalled.  I
> have
> no control over the firewall.  I noticed an IP address had downloaded
> 450 megs from somewhere on my LAN. I tried pinging the address and
> couldn't reach it from my LAN ditto http and nslookup.
>
> I came home and logged on to my ISP. I could ping the ip but could not
> ftp,
> telnet, or http to the address. Nslookup failed.
>
> I should also note that NTOP reported most of the traffic as UDP.
>
> My question is how do I figure out what happened? Is there anyway of
> determing
> what the IP is?
>
> TIA



--
Russell T. Enderby                                        Arris Interactive

Software Engineer                                         3871 Lakefield
Dr, Suite 300
Cornerstone Software Development Group   Suwanee, GA 30024-1242
Email: Russell.Enderby at arris-i.com