Get whois name and location for IP addresses in bulk

Hello everyone,

We run a Citrix server with a web frontend (NFuse), and my boss asked
if I could get a list of companies and locations for folks who are
hitting the server. I have a list of about 500 IP addresses, and
though I can identify blocks as being local ISP's, the other 200+
aren't as easily recognized. I can do a whois on them and get this
info, but anyone know of a quicker way or script in Linux or Windows
that can process all the IP's and give me a list of who each of them
are?

Just curious --

Alex

Fleeing from the madness of the http://groups.google.com jungle
samalex <(E-Mail Removed)> stumbled into
news:comp.os.linux.networking,alt.www.webmaster
and said:

> Hello everyone,
>
> We run a Citrix server with a web frontend (NFuse), and my boss asked
> if I could get a list of companies and locations for folks who are
> hitting the server. I have a list of about 500 IP addresses, and
> though I can identify blocks as being local ISP's, the other 200+
> aren't as easily recognized. I can do a whois on them and get this
> info, but anyone know of a quicker way or script in Linux or Windows
> that can process all the IP's and give me a list of who each of them
> are?
>
> Just curious --

perl has a whois module (or whatever they're called in perlspeak)

almost any language has facilities (or libraries) to make network calls
that you could shoe-horn into service for calls to whois

--
William Tasso

http://williamtasso.com/words/what-is-usenet.asp

In news:(E-Mail Removed) oups.com,
samalex <(E-Mail Removed)> wrote:

> We run a Citrix server with a web frontend (NFuse), and my boss asked
> if I could get a list of companies and locations for folks who are
> hitting the server. I have a list of about 500 IP addresses, and
> though I can identify blocks as being local ISP's, the other 200+
> aren't as easily recognized. I can do a whois on them and get this
> info, but anyone know of a quicker way or script in Linux or Windows
> that can process all the IP's and give me a list of who each of them
> are?

http://www.jdrowell.com/archives/200...me_for_jd.html has a very
useful Perl script called jdresolve that will even recurse into C, B, and A
address spaces when there is no PTR record for an IP address, e.g.:

jdresolve -a -r -n apache.log > apache.log_resolved

and then use any number of freely-available log analyzers to parse the
apache.log_resolved file (or ftp, whatever) and see how many times each
company has "hit" the site. It can maintain a local database to minimize the
amount of DNS queries if optioned.

In news:(E-Mail Removed), I wrote:

> http://www.jdrowell.com/archives/200...me_for_jd.html has a
> very useful Perl script called jdresolve that will even recurse into
> C, B, and A address spaces when there is no PTR record for an IP
> address, e.g.:
>
> jdresolve -a -r -n apache.log > apache.log_resolved
>
> and then use any number of freely-available log analyzers to parse the
> apache.log_resolved file (or ftp, whatever) and see how many times
> each company has "hit" the site. It can maintain a local database to
> minimize the amount of DNS queries if optioned.

For example, using your IP address:

$ nslookup -sil 65.172.176.66
Server: w.x.y.z
Address: w.x.y.z#53

** server can't find 66.176.172.65.in-addr.arpa: NXDOMAIN

$ echo 65.172.176.66 | jdresolve -r -n -
65.172.176.66.sprintlink.net

"samalex" <(E-Mail Removed)> writes:

>Hello everyone,

>We run a Citrix server with a web frontend (NFuse), and my boss asked
>if I could get a list of companies and locations for folks who are
>hitting the server. I have a list of about 500 IP addresses, and
>though I can identify blocks as being local ISP's, the other 200+
>aren't as easily recognized. I can do a whois on them and get this
>info, but anyone know of a quicker way or script in Linux or Windows
>that can process all the IP's and give me a list of who each of them
>are?


Sounds like you r boss is trying to go out of business. Customers discover
that if they go to your site, they get hounded, and you will rapidly have
none.

Unruh <unruh-(E-Mail Removed)> wrote:
> Sounds like you r boss is trying to go out of business. Customers discover
> that if they go to your site, they get hounded, and you will rapidly have
> none.

Actually it sounds pretty reasonable to me. The information itself
could give the OP's company some idea of market penetration. This can
then lead to more appropriate marketing with less annoyance to those
who are either already hooked or clearly not interested. A potential
win-win situation for everyone.

Chris