IP Address info

[stone]

Having a discussion with a friend regading IP addresses and how much info can be gleaned from. What are the facts? Thanks

I'm not Goggs before any fecker asks

[magic torch]

Before this gets moved.

You could liken it to phoning someone with caller id. When you're on the net you're displaying your phone number 'ip address'.

Sometimes they're leased and will be different each time you connect. Other times you can tell which company they're working for if it's a corporate IP address.

You can also see what browser and operating system they're using.

[Joe911]

magic torch said:

You can also see what browser and operating system they're using.

Not based on the IP address alone you can't.
As Magic says, you can pretty much guarantee to know what country the user is in and there is some hope of finding the city too. Again, as Magic says, you can sometimes tell which company the user access the Internet through.
You also, sometimes, get quite misleading info for braodband users - like many BT customer appear to be in Scotland.
Sometimes the IP address given for a user is wrong (or if not techinically wrong, quite misleading) - for example AOL users are often effectively "hidden" behind a "proxy server" and you may only get the IP address of the proxy server and not of the user.

Loads of really useful IP address geek stuff here: www.dnsstuff.com/

[magic torch]

Sorry, worded badly. Meant to say it's also possible to see.

[aldi]

The most usefull ones are where someones posting from their work address, then a whois will often give you where they work. That combined with a name could be quite usefull! If its a current address you could then go on to use standard tools like nmap or whatever to idenfify what services are running, look for standard exploits for them and maybe end up getting in there in some form or other.


If you were the police of course you could just get the ISP to give up the billing info & associated phone line, then go and kick the door in

[stone]

Thanks

[roadsweeper]

You can usually tell what geographical location the user is in (generally to the level of the city they are in) too. Often you can tell which ISP they use too.

[guydw]

IP address are (currently) a 32 bit number formed into 4 octets. There are two parts, the network address and the host address. They are assigned to organisations by the local registry organisation - in the case of Europe and Africa it is RIPE. You can look up IP addresses in the RIPE database and that will tell you who the address is registered to. This will not necessarily tell you where an actual host is. More specific host information can be found by looking up DNS information - which ties an IP address to a host name (i.e. www.cisco.com) - although you can't tell for sure where this will be.

Often the IP address you see will be a router owned by the ISP that owns the IP address - they will then have their own private network hidden behind their internet facing routers using RFC1918 addresses (10.x.x.x , 192.168.x.x , 172.16-32.x.x) these are what any corporation worth its salt will be using and are not routable from the internet.

check out: www.ripe.net, www.bgp4.as, www.enterprisenetworkingplanet.com/netsp/article.php/3613781,
www.traceroute.org

[onomatopoeia]

aldi said:

If its a current address you could then go on to use standard tools like nmap or whatever to idenfify what services are running, look for standard exploits for them and maybe end up getting in there in some form or other.

For anyone thinking of trying this, remember that most clued up ISPs take a very dim view of their users using nmap or the like on an IP address that the owner hasn't given permission for.

[guydw]

very good point !!!!

nmap - makes you feel clever, but expect your ISP to cut you off if they spot you doing it.