ip address ?

[sam111]

I am wondering is their away to figure out what ip address's belong to which company.

I know nslookup or a dns tool can give you a name from an ip or an ip from a name.

But I am looking to figure out what ip address's an isp provider has available for it's clients.

For example say I want to figure out what ip address's belong to comcast or at least what are the ip address's that comcast has to use for it's clients. I.E what are all the address's for all comcasts dhcp servers pools of address's???

 

[PvilleStang]

If you know an IP address, you can use an IP address locator to find it's ISP (well, it works a lot of the time). Problem is that they don't tend to publish their IP scopes for security purposes. And say Comcast is allotted a scope 123.123.0.0/16, they will split that range into static assigned and DHCP assigned IP's, which they will manage internally. You might be able to find an old allocation table somewhere on the interwebs, but it's most likely outdated, and the IP range allocation changes often.

Your best bet is if you know the IP address, check an IP locator site and see if you can back trace the location and provider. Also, contact the ISP and they may be able to tell you their IP's available for static assignment.

 

[sam111]

Ok, is their any easy way given an ip address to determine if it is a static ip address or a dynamic assigned one given out by a dhcp server? (provided you do not have physical access/login access to this machine) Basically given a wan ip address is their away to figure out if it is static or dynamic ip address?

two is their away to figure out what dhcp server gave/assigned a given ip address to a computer from a third party computer. For example given a wan dynamicly assigned ip address is their away to come up with the ip address of the dhcp server that issued it?

 

[root]

if you look for gnuwin32 applications and install jwhois (or just install jwhois if you;re using linux) then you can query addresses directly

jwhois 1.0.0.0
inetnum: 1.0.0.0 - 1.0.0.255
netname: Debogon-prefix
descr: APNIC Debogon Project
descr: APNIC Pty Ltd
country: AU
admin-c: GM85-AP
tech-c: GM85-AP
mnt-by: APNIC-HM
mnt-routes: MAINT-AU-APNIC-GM85-AP
mnt-irt: IRT-APNICRANDNET-AU
status: ASSIGNED PORTABLE
changed: hm-changed@apnic.net 20110811
source: APNIC

jwhois 1.0.1.0
inetnum: 1.0.1.0 - 1.0.1.255
netname: CHINANET-FJ
descr: CHINANET FUJIAN PROVINCE NETWORK
descr: China Telecom
descr: No.31,jingrong street
descr: Beijing 100032
country: CN


jwhois 1.0.2.0
inetnum: 1.0.2.0 - 1.0.3.255
netname: CHINANET-FJ
descr: CHINANET FUJIAN PROVINCE NETWORK
descr: China Telecom
descr: No.31,jingrong street
descr: Beijing 100032
country: CN

you could write a script to go through the whole range.

That's an example of what the poster above was saying, that Chinese Telecom company actually own 10.0.1.0/24 and 10.0.2.0/24 (these are contiguous blocks, but can't just be 10.0.1.0/23 (as that range is 10.0.0.1 - 10.0.1.254)

there are other examples such that companies might have more than one range, and they may not be contiguous...
for example...
inetnum: 217.45.195.192 - 217.45.195.199
owned by BT
inetnum: 81.129.0.0 - 81.129.255.255
also owned by BT

You may also find that a company owns a block, whole block, but historically may have bought that block at two times.

So you may have hypothetically a 1.0.0.0 - 1.0.1.254 block owned by the same company, but instead of being 1.0.0.0/23 the block is split in half as 1.0.0.0/24 and 10.0.1.0/24

The tool I mentioned above will let you search out details of IP addresses and link back to block owners, but I do not think that there is a complete and ready made list.

certain blocks may be assigned to certain countries historically, so a popular trick on websites is to just drop all traffic from china on English only web pages as a surprising amount of hacking attempts and spam comes from China...

though having just noted that 10.0.1.0 - 10.0.2.255 is actually what should be American owned IP addresses serving a Chinese Telecom company, you may find that this geographical region of IP address allocation no longer works.

 

[sam111]

Is their a tool that also tells you weather a wan ip address is s dynamic one (i.e assigned from a dhcp server pool of address's owned by some company)? Or is their no way to tell the difference between a wan static / dynamic ip address?

Also if I was given a random wan ip address could I tell what country the ip address is from?
If so how accurate can I get to the location ? (just the country , or can I get to the city , town , bussniess address , floor ...etc)