ip tracing

can pretty easily figure out that he
uses ISP III to connect to the internet. Right? You might say that any idiot would be able to do this. Well, yes and no.
You see, the above method of finding out the ISP of a person was successful only because we already had the ISPand Network Address Allotted list with us. So, what my point is, that the above method can be successful only after a
lot of research and experimentation. And, I do think such research can be helpful sometimes.
Also, this would not work, if you take it all on in larger scale. What if the IP that you have belongs to someone living
in a remote igloo in the North Pole? You could not possibly get the Network Addresses of all the ISP’s in the world,
could you?
NOTE: In the above case, you also get to know the city of the system using the given IP, as most ISP’s use different
network addresses in different cities. Also, some ISP’s are operational in a single city.
So, is there a better method of getting the location of an IP? Yes, Reverse DNS lookups hold the key.
Just as DNS lookup converts the hostname into IP address, a Reverse DNS Lookup converts the IP address of a host
to the hostname. By hostname, what I mean to say is that it given us the name of the remote system in alphabets and
numbers and periods. For Example, mail2.bol.net.in would be a hostname, while 203.45.67.98 would not be a
hostname.
The popular and wonderful Unix utility ‘nslookup’ can be used for performing Reverse DNS lookups.
So, if you using a *nix box or if you have access to a shell account, then the first this to do is to locate where the
nslookup command is hidden by issuing the following command:
' whereis nslookup '.
Once you locate where the utility is hidden, you could easily use it to perform both normal and reverse DNS lookups.
As this is not a manual on using the ‘nslookup’ command, I will simply giving a basic relevant outline. In order to
get a more detailed description of how this works or how to use it, read the *nix man pages or the documentation.
We can use ‘nslookup’ to perform a reverse DNS lookup by mentioning the IP of the host at the prompt.
For Example,
$>nslookup IP Address
Note: The below IP’s and corresponding hostnames have been made up. They may not actually exist.
Let us say, that above, instead of IP Address, we type 203.94.12.01 (which would be the IP I want to trace.).
$>nslookup 203.94.12.01
Then, you would receive a response similar to: mail2.bol.net.in
Now, if you carefully look at the hostname that the Reverse DNS lookup, gave us, then the last part reveals the
country in which system resides in. You see, the ‘.in’ part signifies that the system is located in India. All countries
have been allotted country codes, which more often than not are the last part of the hostnames of the systems located
in that country. This method can also be used to figure out as to which country a person lives in, if you know his email address. For Example, if a person has an email address ending in .ph then he probably lives in Philippines and
if it ends in .il then he lives in Israel and so on. Some common country codes are:


Country Code

Australia .au

Indonesia .id

India .in

Japan .jp

Israel .il

Britain .uk

For a complete list of country codes, visit:

http://www.alldomains.com/
http://www.iana.org/domain-names.html

General Extra Tip: To get the complete list of US State Abbreviation codes, visit:
http://www.usps.gov/ncsc/lookups/abbr_state.txt

Windows users can perform Reverse DNS queries by downloading an utility called Samspade from:
http://www.samspade.com/

Another method of getting the exact geographical location of a system on the globe is by making use of the WHOIS database. The WHOIS database is basically the main database, which contains a variety of information like contact details, name etc on the person who owns a particular domain name. So, basically what one does in a WHOIS query, is supply the WHOIS service with the hostname on which he wants more information. The WHOIS service then replies with the information stored in its database. This method can be used to get some pretty accurate information on a particular IP or hostname; however, it is probably of no use if you are trying to point out the exact location of a dynamic IP. But, again this can be used to get atleast the city in which the ISP used by the victim is situated.
You can carry out WHOIS queries at: http://www.alldomains.com/
You could also directly enter the following in the location bar of your Browser and perform a WHOIS enquiry.
Enter the following in the location bar of your browser:
http://205.177.25.9/cgi-bin/whois?abc.com
Note: Replace abc.com with the domain name on which you want to perform a WHOIS query.
This method cannot be used to get the contact address of a person, if the IP that you use to trace him, belongs to his
ISP. So, either you need to know the domain name (which is registered on his name) or have to remain satisfied
knowing only the city (and ISP) used by the person.