It appears that the block on port 80 was either just
for the duration of heavy Code Red/NIMDA attacks, OR
possibly for having a home page with links on it.  It
appears that outside access to my web server is once
again possible.

  At any rate, I've cleaned up the web interface to
ipw somewhat, 

http://wizard.dyndns.org/cgi-bin/ipw.pl

and also put a link there for the entire tarball rather 
than just the ipw.c file (though the tarball only
consists of ipw.c and a simple Makefile anyway).

  For those who don't remember what ipw is/does, it's
a program which looks up an IP address to determine who 
the netblock owner is.

  Tools such as 'host' and 'nslookup' only go as far as 
your DNS to determine an IP.  Oftentimes, your DNS won't 
have that info.

  For instance, a spam (or was it an attack?) I 
received originated at 202.98.196.68.  

$ host 202.98.196.68   only resulted in
Host not found.

and

$ nslookup 202.98.196.68   only gives
Server:  ns1.gwi.net
Address:  207.5.128.9

*** ns1.gwi.net can't find 202.98.196.68: Non-existent host/domain

BUT!

$ ipw 202.98.196.68 
gives all the info one would need to write a nastygram.

http://wizard.dyndns.org/cgi-bin/ipw.pl?host=202.98.196.68
will give you the exact same info... and of course, it's
Arachne-friendly.

 - Steve


Reply via email to