Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We were contacted by our ISP saying that one of our servers was issuing an attack on another computer.

May 23 14:11:35 wdc lfd[14308]: *Port Scan* detected from ***.***.***.***
(US/United States/-). 11 hits in the last 245 seconds - *Blocked in csf* for
3600 secs [PS_LIMIT]

I don't know what it means, but our server is a factory image, with only a couple programs running.

I would like to know the domain, but don't know how to look it up.

share|improve this question

7 Answers 7

up vote 6 down vote accepted

Use nslookup

For example, let's find the domain for 207.46.19.254

C:\>nslookup -type=PTR 254.19.46.207.in-addr.arpa   
Non-authoritative answer:                                                   
254.19.46.207.in-addr.arpa      name = wwwbaytest2.microsoft.com            

Note that you reverse the order of the four numbers and append .in-addr.arpa

Remember that an IP-address may have multiple domains, and that the administrators do not always (but mostly should) set up the reverse mappings in DNS.

share|improve this answer

Two things you can do. One is reverse DNS lookup.

dig -x x.x.x.x

You can also use geoiplookup to find the general area of the source.

share|improve this answer

ARIN WHOIS is probably the default goto for resolving IPs to the registered names, although I use SANS often also. The search box on both sites is in the upper right corner.
This will only resolve domain names on the internet, not internal domain names you may be looking for.

share|improve this answer
    
I think you meant to pop that comment next to my answer about how the issue could be with any computer behind a NAT router - but now that you have said that NAT's not involved, I've deleted my answer. Hope you manage to track down this issue. –  Linker3000 May 23 '11 at 19:05
    
Ah - you've now moved your remark next to my deleted answer!!! I think we're playing cat and mouse!!! I'll leave my comments though so that everyone sees that NAT is not involved. –  Linker3000 May 23 '11 at 19:07
    
If you have the WAN IP address from your ISP does this not relate to a specific server? –  Linker3000 May 23 '11 at 19:10

DomainTools whois and reverse dns has always been my go-to for easy and accurate sluething of this sort.

http://www.domaintools.com/

share|improve this answer
    
Checkout www.nwtools.com = very useful –  paradroid May 23 '11 at 20:42

Wouldn't the ping -a command also work?

That is, ping -a insert IP address here. It's not always successful though, but it's likely the easiest method.

share|improve this answer

A whois from the command line gets me quite a lot of information, or you can always try a Network Lookup or Whois at www.nwtools.com

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.