Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-21 Thread guitarlynn
On Wednesday 21 August 2002 08:33, David Douthitt wrote: > Why not just use jwhois (or other whois client)? Personally, since I have several full-blown *NIX distro's available here, I simply use the "whois" command. This queries your ISP's nameserver(s), which works for me since I already know

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-21 Thread Cass Tolken
Hi David, --- David Douthitt <[EMAIL PROTECTED]> wrote: > On Tue, Aug 20, 2002 at 09:40:57AM -0700, Cass Tolken wrote: > > > Arin is for American IPs, you can further modify my script modifications to > > include European, Asian, etc. IPs as an exercise ;) > > Why not just use jwhois (or other

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-21 Thread David Douthitt
On Tue, Aug 20, 2002 at 09:40:57AM -0700, Cass Tolken wrote: > Arin is for American IPs, you can further modify my script modifications to > include European, Asian, etc. IPs as an exercise ;) Why not just use jwhois (or other whois client)? Jwhois is a GNU project and automatically knows which

RE: [leaf-user] Identifying the "scanning" culprit???

2002-08-21 Thread Julian Church
Hi Joey There's nothing wrong with what Cass is telling you, but I get the impression a simpler approach might also be suitable. There already exist online tools to do just what you are trying to do. I generally use the following site, but there are others (try Googling for "ipwhois") http:/

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread chuck
viewlogs. Again I'm not familiar w/ the html and > > all of this, but I'd like to do this to atleast let the offending machines > > be aware of my dissatisfaction... > > > > Joey > > > > > > -----Original Message- > > From: Cass Tolke

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Cass Tolken
Hi Craig, --- Craig <[EMAIL PROTECTED]> wrote: > Hi folks, > I've copied the files that Cass referred to earlier to my > /var/sh-www/cgi-bin directory, and I've issued the following > commands...but my weblet just shows blank screens when I try to view the > logs-Hmmm, I wonder what I'm doing wro

RE: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Cass Tolken
t let the offending machines > be aware of my dissatisfaction... > > Joey > > > -Original Message- > From: Cass Tolken [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, August 20, 2002 11:41 AM > To: [EMAIL PROTECTED]; LEAF > Subject: RE: [leaf-user] Identifying the "

RE: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Joey Officer
al Message- From: Cass Tolken [mailto:[EMAIL PROTECTED]] Sent: Tuesday, August 20, 2002 11:41 AM To: [EMAIL PROTECTED]; LEAF Subject: RE: [leaf-user] Identifying the "scanning" culprit??? Hi Joey, I mentioned below in my example that the modification is in /var/sh-www/cgi-bin/viewhits sp

RE: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Joey Officer
odify... Sorry for being ignorant on the matter... Joey -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Cass Tolken Sent: Tuesday, August 20, 2002 9:40 AM To: Craig; LEAF Subject: Re: [leaf-user] Identifying the "scanning" culprit??? Hello a

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Cass Tolken
Hi Craig, It might be easier to just upload my scripts so that you (or anyone else interested) can download them. Beware ugly geocites page!! ;) http://www.geocities.com/casstolk/index.html Have fun! --- Craig <[EMAIL PROTECTED]> wrote: > Hi Cass, > Wow...that looks pretty cool. Unfortunate

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Cass Tolken
Hello again Craig, If you're using weblet (Bering comes with it default) you can so something like this: in /var/sh-www/cgi-bin/viewhits, hitssort) sed 's/\(.\{6\}\)\(.*SRC=\)\(.*\)\( DST=.*\)/\<\/td\>\\A rin\<\/a\> - \\3\<\/a\><\/td\>\\1\<\/td\>\<\/tr\>/'|\ so that I can just click to query a

Re: [leaf-user] Identifying the "scanning" culprit???

2002-08-20 Thread Cass Tolken
Hi Craig, Try: http://ws.arin.net/cgi-bin/whois.pl --- Craig <[EMAIL PROTECTED]> wrote: > Hi folks, > I often see a lot of messages in my Bering logs from the 12.246.x.x > network, which I suspect is my ISP. Is there any way you can accurately > identify who a network/subnet belongs to? Thank