5 ms·

What are some good books/resources on things like "allocated" and "assigned" IP addresses? i.e. Internet governance, and IP in general? Where is he getting t

by chubot 12y ago

What are some good books/resources on things like "allocated" and "assigned" IP addresses? i.e. Internet governance, and IP in general? Where is he getting the data like: "inetnum: 175.45.176.0 - 175.45.179.255 ..."? Also are there tools that take a list of services on ports and map it to likely hardware/OS? I have been programming for a long time but somehow I missed out on this kind of networking knowledge. Are most people who know this stuff network engineers?

decwakeboarder 12y ago
Wikipedia has a great map of ports to registered and common services: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number... Nmap can scan and show the application and version based on various responses and req/response fingerprinting: http://nmap.org/book/vscan-examples.html http://nmap.org/book/vscan-examples.html
- yourad_io 12y ago
  also, very conveniently under /etc/services (Linux, MacOS) $ grep SSH /etc/services ssh 22/tcp # SSH Remote Login Protocol $
  - teddyh 12y ago
    I’d use “getent”: $ getent services ssh ssh 22/tcp $
    - percept 12y ago
      Tried to find the Darwin equivalent, without success. (Besides looking at the file, but where's the fun in that?)
rid 12y ago
The whois utility [1] is available on most Linux distros and *nix flavours, it will give you information such as: - Using an IP, netrange and information regarding the network owner (contact and abuse info). Gathered from the Regional Internet Registry (RIR) databases. - Using a domain, registrant info --if public, abuse details etc.. [1] http://linux.die.net/man/1/whois http://linux.die.net/man/1/whois
zambon 12y ago
I learned these things by setting up servers. Install a few boxes and get them online without any help from a cloud provider. Everything will quickly become clear.
yourad_io 12y ago
> Where is he getting the data like: "inetnum: 175.45.176.0 - 175.45.179.255 ..."? You're missing `whois`[1]. The wikipedia page is very informative. If you give it an IP, it will give you "ownership" status of that particular IP, and then its containing netblocks ("outwards"). Example: (my favourite IP) $ whois 5.9.6.9 % Information related to '5.9.6.0 - 5.9.6.31' inetnum: 5.9.6.0 - 5.9.6.31 netname: HETZNER-RZ16 descr: Hetzner Online AG descr: Datacenter 16 country: DE --8<-- % Information related to '5.9.0.0/16AS24940' route: 5.9.0.0/16 descr: HETZNER-RZ-FKS-BLK5 origin: AS24940 mnt-by: HOS-GUN source: RIPE # Filtered It gives you more things like contact information, abuse contact details, etc. With a domain, it looks up the domain registration information. If you ever script around whois, be prepared for loads of surprises, such as: * Structure & format variations per provider (can be different on a TLD level) * Some TLDs may not provide that information in a whois format at all: $ whois test.gr This TLD has no whois server, but you can access the whois database at https://grweb.ics.forth.gr/whois_en.jsp [1] http://en.wikipedia.org/wiki/Whois http://en.wikipedia.org/wiki/Whois
- chubot 12y ago
  OK thanks... I've used whois before, but yeah the output has been a bit confusing to me. I think I usually use it with a host name, and using it with an IP gives different info. I am interested in how the databases that 'whois' queries are populated... the Wikipedia page looks like it will have some good pointers.
  - yourad_io 12y ago
    You may also be interested to know that this database is open[1]: > We produce daily snapshots which are available to the public. You can find these files at our FTP site at: ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz > or split by object type at: ftp://ftp.ripe.net/ripe/dbase/split > These daily snapshots exclude the object types: person, role, organisation and mntner. For data protection reasons, personal data is not available in bulk format. [1] To avoid confusion, that isn't just Europe (whose Regional Internet Register is RIPE NCC) but contains other continents/RIR data. [1] https://www.ripe.net/data-tools/db/faq/faq-db/can-i-download-the-ripe-database https://www.ripe.net/data-tools/db/faq/faq-db/can-i-download...
finnn 12y ago
In addition to the tools mentioned to perform the lookups on a specific IPs and such, I find Hurricane Electric BGP Toolkit (http://bgp.he.net http://bgp.he.net) super handy for this sort of thing
justin_ 12y ago
Some general info about IP at the global scale: IP addresses are assigned by regional internet registries[1] (RIR) like ARIN (for North America) and APNIC (for Asia-Pacific regions). Addresses are assigned in blocks like the /22 mentioned in the article. These prefixes are then associated with Autonomous Systems, which participate in routing. You can view routing information on looking glass servers[2] or by using a tool like Hurricane Electric's BGP toolkit: http://bgp.he.net http://bgp.he.net . For example, here's the data for Cloudflare's AS (which serves HN): http://bgp.he.net/AS13335 http://bgp.he.net/AS13335 . You can look at the prefixes it serves and who they peer with. [1] https://en.wikipedia.org/wiki/Regional_Internet_registry https://en.wikipedia.org/wiki/Regional_Internet_registry [2] https://en.wikipedia.org/wiki/Looking_Glass_server https://en.wikipedia.org/wiki/Looking_Glass_server

by chubot 12y ago

decwakeboarder 12y ago

Wikipedia has a great map of ports to registered and common services: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number... Nmap can scan and show the application and version based on various responses and req/response fingerprinting: http://nmap.org/book/vscan-examples.html http://nmap.org/book/vscan-examples.html

yourad_io 12y ago
also, very conveniently under /etc/services (Linux, MacOS) $ grep SSH /etc/services ssh 22/tcp # SSH Remote Login Protocol $
- teddyh 12y ago
  I’d use “getent”: $ getent services ssh ssh 22/tcp $
  - percept 12y ago
    Tried to find the Darwin equivalent, without success. (Besides looking at the file, but where's the fun in that?)

rid 12y ago

The whois utility [1] is available on most Linux distros and *nix flavours, it will give you information such as: - Using an IP, netrange and information regarding the network owner (contact and abuse info). Gathered from the Regional Internet Registry (RIR) databases. - Using a domain, registrant info --if public, abuse details etc.. [1] http://linux.die.net/man/1/whois http://linux.die.net/man/1/whois

zambon 12y ago

I learned these things by setting up servers. Install a few boxes and get them online without any help from a cloud provider. Everything will quickly become clear.

yourad_io 12y ago

> Where is he getting the data like: "inetnum: 175.45.176.0 - 175.45.179.255 ..."? You're missing `whois`[1]. The wikipedia page is very informative. If you give it an IP, it will give you "ownership" status of that particular IP, and then its containing netblocks ("outwards"). Example: (my favourite IP) $ whois 5.9.6.9 % Information related to '5.9.6.0 - 5.9.6.31' inetnum: 5.9.6.0 - 5.9.6.31 netname: HETZNER-RZ16 descr: Hetzner Online AG descr: Datacenter 16 country: DE --8<-- % Information related to '5.9.0.0/16AS24940' route: 5.9.0.0/16 descr: HETZNER-RZ-FKS-BLK5 origin: AS24940 mnt-by: HOS-GUN source: RIPE # Filtered It gives you more things like contact information, abuse contact details, etc. With a domain, it looks up the domain registration information. If you ever script around whois, be prepared for loads of surprises, such as: * Structure & format variations per provider (can be different on a TLD level) * Some TLDs may not provide that information in a whois format at all: $ whois test.gr This TLD has no whois server, but you can access the whois database at https://grweb.ics.forth.gr/whois_en.jsp [1] http://en.wikipedia.org/wiki/Whois http://en.wikipedia.org/wiki/Whois

chubot 12y ago
OK thanks... I've used whois before, but yeah the output has been a bit confusing to me. I think I usually use it with a host name, and using it with an IP gives different info. I am interested in how the databases that 'whois' queries are populated... the Wikipedia page looks like it will have some good pointers.
- yourad_io 12y ago
  You may also be interested to know that this database is open[1]: > We produce daily snapshots which are available to the public. You can find these files at our FTP site at: ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz > or split by object type at: ftp://ftp.ripe.net/ripe/dbase/split > These daily snapshots exclude the object types: person, role, organisation and mntner. For data protection reasons, personal data is not available in bulk format. [1] To avoid confusion, that isn't just Europe (whose Regional Internet Register is RIPE NCC) but contains other continents/RIR data. [1] https://www.ripe.net/data-tools/db/faq/faq-db/can-i-download-the-ripe-database https://www.ripe.net/data-tools/db/faq/faq-db/can-i-download...

finnn 12y ago

In addition to the tools mentioned to perform the lookups on a specific IPs and such, I find Hurricane Electric BGP Toolkit (http://bgp.he.net http://bgp.he.net) super handy for this sort of thing

justin_ 12y ago

Some general info about IP at the global scale: IP addresses are assigned by regional internet registries[1] (RIR) like ARIN (for North America) and APNIC (for Asia-Pacific regions). Addresses are assigned in blocks like the /22 mentioned in the article. These prefixes are then associated with Autonomous Systems, which participate in routing. You can view routing information on looking glass servers[2] or by using a tool like Hurricane Electric's BGP toolkit: http://bgp.he.net http://bgp.he.net . For example, here's the data for Cloudflare's AS (which serves HN): http://bgp.he.net/AS13335 http://bgp.he.net/AS13335 . You can look at the prefixes it serves and who they peer with. [1] https://en.wikipedia.org/wiki/Regional_Internet_registry https://en.wikipedia.org/wiki/Regional_Internet_registry [2] https://en.wikipedia.org/wiki/Looking_Glass_server https://en.wikipedia.org/wiki/Looking_Glass_server