To summarize with my comments on the different suggestions. http://ip.ludost.net/ - This source just uses registry and bogon info, I can generate that myself. I was looking for sources that provide additional info.
The ntop module "p2c" does lookups via the net. I'm dealing with a lot of IP addresses so this method would take a long time. http://www.maxmind.com/app/geoip_country - This is exactly the kind of thing I was looking for. Free version updated monthly. Excellent. http://hostip.info/ - I am not sure about this one. It seems to rely on users to enter information and is only accurate down to the /24. The method used to store IP information is interesting. http://www.networkthinktank.com/downloads.php - No info on sources, but has an entry for every possible IP. http://ip-to-country.webhosting.info/node/view/9 - Appears to use a combination of RIR data and user info. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
