Tracing internet locations

  • Thread starter Thread starter tl_carter
  • Start date Start date
T

tl_carter

I have Norton Personal Firewall installed.

I get two or three messages a day indicating my computer has been attacked.

I think some of these locations may be from programs I have subscribed to.

How do I identify the site contacting my computer from the internet location shown in the Norton Personal Firewall in the format nn.nnn.nn.nn (i.e. 24.153.64.68)??

--
thanks;
tlc...

"Knowledge is of two kinds: we know a subject ourselves, or we know where we can find information on it". Samuel Johnson













"Knowledge is of two kinds: we know a subject ourselves, or we know where we can find information on it". Samuel Johnson
 
You can use: http://ws.arin.net/cgi-bin/whois.pl

This site will tell you the owner of IP address (probably an ISP). You can
then e-mail to the abuse e-mail provided in the search results. Make sure
you e-mail them your firewall log indicating the attacks from that IP
address. The ISP can find out which customer had that IP address at the time
of the attack.
--------------------------------------------------------------------
When searching your example: 24.153.64.68

Search results for: ! NET-24-153-64-0-1
OrgName: Comcast Cable Communications
OrgID: CCCS
Address: 3 Executive Campus
Address: 5th Floor
City: Cherry Hill
StateProv: NJ
PostalCode: 08002
Country: US

NetRange: 24.153.64.0 - 24.153.79.255
CIDR: 24.153.64.0/20
NetName: EASTERNSHORE-1
NetHandle: NET-24-153-64-0-1
Parent: NET-24-0-0-0-0
NetType: Direct Allocation
NameServer: NS1-AUTH.SPRINTLINK.NET
NameServer: NS2-AUTH.SPRINTLINK.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
Comment:
RegDate: 2001-09-18
Updated: 2003-04-08

TechHandle: GZ64-ARIN
TechName: Zeibari, Greg
TechPhone: +1-856-317-7290
TechEmail: (e-mail address removed)

OrgAbuseHandle: NAPO-ARIN
OrgAbuseName: Network Abuse and Policy Observance
OrgAbusePhone: +1-856-317-7272
OrgAbuseEmail: (e-mail address removed)

OrgTechHandle: IC161-ARIN
OrgTechName: Comcast Cable Communications, Inc.
OrgTechPhone: +1-856-317-7300
OrgTechEmail: (e-mail address removed)

# ARIN WHOIS database, last updated 2003-07-22 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.


--
HTH

- Jeff

[WINNT 4 - SP 6, XP, IE 6, Office 2000, XP Professional, 1 GIG RAM,
1 GHz Pentium 3, Matrox Millennium AGP, (3) 20 Gig HD]

I have Norton Personal Firewall installed.

I get two or three messages a day indicating my computer has been attacked.

I think some of these locations may be from programs I have subscribed to.

How do I identify the site contacting my computer from the internet location
shown in the Norton Personal Firewall in the format nn.nnn.nn.nn (i.e.
24.153.64.68)??

--
thanks;
tlc...

"Knowledge is of two kinds: we know a subject ourselves, or we know where we
can find information on it". Samuel Johnson







"Knowledge is of two kinds: we know a subject ourselves, or we know where we
can find information on it". Samuel Johnson
 
WhoIs
America Registry for Internet Numbers (ARIN).Information
on network names, network numbers, ASNs and host
information as well as the names, addresses, telephone
numbers, and e-mail addresses for Points of Contact.
http://ww2.arin.net/whois/

enter the i.p. address in the search box.
You will at least find out the provider. You may want to
sent them a message with at the details from your Firewall.



-----Original Message-----
I have Norton Personal Firewall installed.

I get two or three messages a day indicating my computer has been attacked.

I think some of these locations may be from programs I have subscribed to.

How do I identify the site contacting my computer from
Click to expand...
the internet location shown in the Norton Personal
Firewall in the format nn.nnn.nn.nn (i.e. 24.153.64.68)??
--
thanks;
tlc...

"Knowledge is of two kinds: we know a subject ourselves,
Click to expand...
or we know where we can find information on it". Samuel
Johnson
"Knowledge is of two kinds: we know a subject ourselves,
Click to expand...
or we know where we can find information on it". Samuel
Johnson
 
I have Norton Personal Firewall installed.

I get two or three messages a day indicating my computer has been attacked.

I think some of these locations may be from programs I have subscribed to.

How do I identify the site contacting my computer from the internet location shown in the Norton Personal Firewall in the format nn.nnn.nn.nn (i.e. 24.153.64.68)??
Click to expand...

http://www.faqs.org/faqs/firewalls-faq/

HTH


--
siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_
 
Back
Top