On Wed, 1 Oct 2003, Tim White wrote:
> > ARIN keeps a list of first-level allocations. A whois query > > to whois.arin.net for the IP address of interest should > > provide you with a record, from which you can retrieve the > > country code and see if it evaluates to AU. Try it - run > > 'whois 203.1.2.3 | grep "^country:"' in a terminal. > > Lovely. Repeat with any IP address you like, maybe even > > write a bit of awk > > or sed or something to strip out everything except the country code. > > Once you find out who ARIN has allocated the IP range to, you can > usually go and check their whois server. > > An example would be to do 'whois 203.1.2.3 @whois.apnic.net'. This will > give you the name and address that APNIC have allocated the IP address > to. Often these will be ISPs, some of whom have their own whois servers > and so on. Thanks for suggestions. I guess I should not have been so cryptic in my question. Whois is not really an option because I'm trying to analyse a http log with thousands of entries. It's useful to know if the hit is local or foreign. It's not hard to find out where a given ip number comes from, but I was looking for a simple generic test - eg: all .au numbers are in the range 203.1.0.0 I'll keep looking. -- SLUG - Sydney Linux User's Group - http://slug.org.au/ More Info: http://lists.slug.org.au/listinfo/slug
