none
Identifying ISP from external IP address

    Question

  • Does anyone know how I could get my app to show the ISP of the machine it is running on, I can get internal and external IP addresses, just need to know if possible and how to look up ISP from this information

    Some websites manage to do this such as http://www.danasoft.com/ so I assume it must be somehow possible

    Thanks in advance


    Darren Rose
    Monday, July 25, 2011 7:43 PM

Answers

  • As far as IPV4, I have an app I wrote to get a name from an IP Address, it uses a table that looks like this:

    000|whois.arin.net

    001|whois.apnic.net

    002|whois.ripe.net

    003|whois.arin.net

    004|whois.arin.net

    etc etc to 255

    This gets loaded and split at the "|" into a hashtable, which finds the whois server based on the Class A octet. The first set of numbers is that octet, left padded with zeros and the second is the whois server to query.

    For example, entering 4.2.2.1 in my form gives this (lots edited out for brevity)

    NetRange: 4.0.0.0 - 4.255.255.255

    CIDR: 4.0.0.0/8

    OrgName: Level 3 Communications, Inc.

    OrgId: LVLT

    Address: 1025 Eldorado Blvd.

    City: Broomfield StateProv: CO

    PostalCode: 80021 Country: US

    I would be glad to get the table to you and maybe some code to get you started if you want.

    • Proposed as answer by Andrew B. Painter Tuesday, July 26, 2011 3:32 PM
    • Marked as answer by wingers Tuesday, July 26, 2011 7:07 PM
    Tuesday, July 26, 2011 3:11 PM

All replies

  • Your first stop is a query at IANA which can tell you the geographical area (typically the continent) where the IP Address Block containing the target IP is assigned.

    Your next stop is a query at a regional IP management agency like ARIN (for North America) which can tell you the actual property owner of the IP Address Block including the general geographic area (possibly as narrow as city and state) of their home or corporate office.

    You may note that when using any 3rd Party lookup tool (like danasoft), querying addresses owned by widespread ISPs like Earthlink, a user in Bumspork, RI may well be assigned an IP Address owned by an entity in Cleveland, OH.


    It never hurts to try. In a worst case scenario, you'll learn from it.
    Monday, July 25, 2011 8:01 PM
  • Thanks, will look into it

    If not other method I thought would be a whois lookup, asI can do this on a website and if I enter external IP it will show me ISP - so just need a way to do this programmatically and a whois website that allows it to be done like that


    Darren Rose
    Monday, July 25, 2011 9:08 PM
  • Yeah.

    You start with IANA, then you go to whatever regional IP distributor IANA specifies.

    That's how an IP WHOIS works.  It'd work exactly the same way if you were doing a domain WHOIS, except there you can pretty much use any registrar's WHOIS feature and webscrape it.

    Nobody's going to provide such a feature for you to embed in your code.  You need to build it or buy one somebody else built.


    It never hurts to try. In a worst case scenario, you'll learn from it.
    Monday, July 25, 2011 9:14 PM
  • As far as IPV4, I have an app I wrote to get a name from an IP Address, it uses a table that looks like this:

    000|whois.arin.net

    001|whois.apnic.net

    002|whois.ripe.net

    003|whois.arin.net

    004|whois.arin.net

    etc etc to 255

    This gets loaded and split at the "|" into a hashtable, which finds the whois server based on the Class A octet. The first set of numbers is that octet, left padded with zeros and the second is the whois server to query.

    For example, entering 4.2.2.1 in my form gives this (lots edited out for brevity)

    NetRange: 4.0.0.0 - 4.255.255.255

    CIDR: 4.0.0.0/8

    OrgName: Level 3 Communications, Inc.

    OrgId: LVLT

    Address: 1025 Eldorado Blvd.

    City: Broomfield StateProv: CO

    PostalCode: 80021 Country: US

    I would be glad to get the table to you and maybe some code to get you started if you want.

    • Proposed as answer by Andrew B. Painter Tuesday, July 26, 2011 3:32 PM
    • Marked as answer by wingers Tuesday, July 26, 2011 7:07 PM
    Tuesday, July 26, 2011 3:11 PM
  • Hi Devon

    Thank you for your reply - that sounds like the sort of thing I need, if you could let me have the table and some code to get me started it would be much appreicated


    Darren Rose
    Tuesday, July 26, 2011 5:27 PM
  • Lets see if I can paste it here

    Imports System.IO
    Imports System.Text
    Imports System.Net.Sockets

    Private whoisTable2 As New Hashtable()

        'note - parameter is named domain but in this case it is being passed an IP address
        Private Function doWhoisQuery(ByVal domain As String, ByVal server As String) As String
            Dim returnData As String = ""
            Dim tcpClient As New TcpClient()
            tcpClient.Connect(server, 43)
            Dim networkStream As NetworkStream = tcpClient.GetStream()
            If networkStream.CanWrite And networkStream.CanRead Then
                Dim sendBytes As [Byte]() = Encoding.ASCII.GetBytes(domain + vbCrLf)
                networkStream.Write(sendBytes, 0, sendBytes.Length)
                Dim bytes(tcpClient.ReceiveBufferSize) As Byte
                Dim recvSize As Int32
                recvSize = networkStream.Read(bytes, 0, CInt(tcpClient.ReceiveBufferSize))
                While (recvSize <> 0)
                    returnData &= Encoding.ASCII.GetString(bytes, 0, recvSize)
                    recvSize = networkStream.Read(bytes, 0, CInt(tcpClient.ReceiveBufferSize))
                End While
            Else
                If Not networkStream.CanWrite Then
                    returnData = "Cannot write data to this stream."
                Else
                    If Not networkStream.CanRead Then
                        returnData = "Cannot read data from this stream."
                    End If
                End If
            End If
            tcpClient.Close()
            Return returnData
        End Function

        'do the nslookup from domain name to IP
        Private Sub btnLookup_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLookup.Click
            Dim domain As String = Trim(txtDomain.Text)
            Dim Ipaddy As System.Net.IPAddress()
            txtIPAddress.Text = String.Empty
            Try
                Ipaddy = System.Net.Dns.GetHostAddresses(domain)
            Catch ex As Exception
                MsgBox("Lookup of " & domain & " caused an error :" & vbCrLf & ex.Message)
                txtDomain.Focus()
                txtDomain.SelectAll()
                Cursor.Current = Cursors.Arrow
                Exit Sub
            End Try
            txtIPAddress.Text = Ipaddy(Ipaddy.Length - 1).ToString
        End Sub

        'below is old and should be replaced with Return System.Net.IPAddress.TryParse(ip, Nothing)
        Private Function isIP(ByVal ip As String) As Boolean
            Dim regex As New RegularExpressions.Regex("^(?:(?:25[0-5]|2[0-4]\d|[01]\d\d|\d?\d)(?(\.?\d)\.)){4}$")
            Return regex.IsMatch(ip)
        End Function

        Private Shared Function LoadWhoisServers2(ByVal filename As String) As Hashtable
            Dim tmpArray() As String
            Dim whoisTable2 As New Hashtable()
            Try
                Dim MyStreamReader As StreamReader = IO.File.OpenText(filename)
                Do While MyStreamReader.Peek() >= 0
                    tmpArray = MyStreamReader.ReadLine().Split("|")
                    whoisTable2.Add(tmpArray(0), tmpArray(1))
                Loop
                MyStreamReader.Close()
            Catch e As Exception
                MsgBox(e.Message + vbLf + "Fatal Error Loading IP Address Server list", MsgBoxStyle.Critical)
                End
            End Try
            Return whoisTable2
        End Function

        Private Shared Function GetInfoServer(ByVal queryTxt As String) As String
            Dim regex As New RegularExpressions.Regex("Whois Server:\s+(.+)", RegularExpressions.RegexOptions.IgnoreCase)
            Dim match As RegularExpressions.Match = regex.Match(queryTxt)
            If (match.Value <> "") Then
                Return match.Value.Substring(14)
            Else
                Return ""
            End If
        End Function

        Private Sub Whois_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
            whoisTable2 = LoadWhoisServers2("IPServers.lst")
        End Sub

        Private Sub BtnWhoisIP_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles BtnWhoisIP.Click
            Dim AClass As String = String.Empty
            Dim lines As String = String.Empty
            Dim server As String = String.Empty
            Dim domain As String = Trim(txtIPAddress.Text)

            If (isIP(domain)) Then
                AClass = domain.Substring(0, domain.IndexOf("."))
                AClass = AClass.PadLeft(3, "0") 'lookup table is in the format ###|server (4 = 004)
                server = whoisTable2.Item(AClass)
                If server Is Nothing Then server = "whois.arin.net"
            Else
                MsgBox("It appears you entered something other than an IP Address.")
                txtIPAddress.Focus()
                txtIPAddress.SelectAll()
                Exit Sub
            End If

            ' display our working status
            If txtWhoisServer.Text <> "" Then server = txtWhoisServer.Text 'server override
            txtResults.Lines = New String() {"Querying whois server(s)...Please wait"}
            txtResults.Refresh()
            ' do the whois query
            Dim whoisResult As String = doWhoisQuery(domain, server)
            ' send the output to the results textbox
            lines &= "[" + server + "]" + vbLf
            lines &= whoisResult + vbLf
            ' check for a redirect whois server
            Dim infoServer As String = GetInfoServer(whoisResult)
            If (infoServer <> "") Then
                whoisResult = doWhoisQuery(domain, infoServer)
                lines &= "[" + infoServer + "]" + vbLf
                lines &= whoisResult
            End If
            txtResults.Lines = lines.Split(vbLf)

        End Sub

     


    IPServers.lst
    000|whois.arin.net
    001|whois.apnic.net
    002|whois.ripe.net
    003|whois.arin.net
    004|whois.arin.net
    005|whois.arin.net
    006|whois.arin.net
    007|whois.arin.net
    008|whois.arin.net
    009|whois.arin.net
    010|whois.arin.net
    011|whois.arin.net
    012|whois.arin.net
    013|whois.arin.net
    014|whois.apnic.net
    015|whois.arin.net
    016|whois.arin.net
    017|whois.arin.net
    018|whois.arin.net
    019|whois.arin.net
    020|whois.arin.net
    021|whois.arin.net
    022|whois.arin.net
    023|whois.arin.net
    024|whois.arin.net
    025|whois.ripe.net
    026|whois.arin.net
    027|whois.apnic.net
    028|whois.arin.net
    029|whois.arin.net
    030|whois.arin.net
    031|whois.ripe.net
    032|whois.arin.net
    033|whois.arin.net
    034|whois.arin.net
    035|whois.arin.net
    036|whois.arin.net
    037|whois.arin.net
    038|whois.arin.net
    039|whois.arin.net
    040|whois.arin.net
    041|hois.afrinic.net
    042|whois.arin.net
    043|whois.arin.net
    044|whois.arin.net
    045|whois.arin.net
    046|whois.ripe.net
    047|whois.arin.net
    048|whois.arin.net
    049|whois.apnic.net
    050|whois.arin.net
    051|whois.ripe.net
    052|whois.arin.net
    053|whois.arin.net
    054|whois.arin.net
    055|whois.arin.net
    056|whois.arin.net
    057|whois.arin.net
    058|whois.apnic.net
    059|whois.apnic.net
    060|whois.apnic.net
    061|whois.apnic.net
    062|whois.ripe.net
    063|whois.arin.net
    064|whois.arin.net
    065|whois.arin.net
    066|whois.arin.net
    067|whois.arin.net
    068|whois.arin.net
    069|whois.arin.net
    070|whois.arin.net
    071|whois.arin.net
    072|whois.arin.net
    073|whois.arin.net
    074|whois.arin.net
    075|whois.arin.net
    076|whois.arin.net
    077|whois.ripe.net
    078|whois.ripe.net
    079|whois.ripe.net
    080|whois.ripe.net
    081|whois.ripe.net
    082|whois.ripe.net
    083|whois.ripe.net
    084|whois.ripe.net
    085|whois.ripe.net
    086|whois.ripe.net
    087|whois.ripe.net
    088|whois.ripe.net
    089|whois.ripe.net
    090|whois.ripe.net
    091|whois.ripe.net
    092|whois.ripe.net
    093|whois.ripe.net
    094|whois.ripe.net
    095|whois.ripe.net
    096|whois.arin.net
    097|whois.arin.net
    098|whois.arin.net
    099|whois.arin.net
    100|whois.arin.net
    101|whois.apnic.net
    102|whois.arin.net
    103|whois.arin.net
    104|whois.arin.net
    105|whois.arin.net
    106|whois.arin.net
    107|whois.arin.net
    108|whois.arin.net
    109|whois.ripe.net
    110|whois.apnic.net
    111|whois.apnic.net
    112|whois.apnic.net
    113|whois.apnic.net
    114|whois.apnic.net
    115|whois.apnic.net
    116|whois.apnic.net
    117|whois.apnic.net
    118|whois.apnic.net
    119|whois.apnic.net
    120|whois.apnic.net
    121|whois.apnic.net
    122|whois.apnic.net
    123|whois.apnic.net
    124|whois.apnic.net
    125|whois.apnic.net
    126|whois.apnic.net
    127|whois.arin.net
    128|whois.arin.net
    129|whois.arin.net
    130|whois.arin.net
    131|whois.arin.net
    132|whois.arin.net
    133|whois.apnic.net
    134|whois.arin.net
    135|whois.arin.net
    136|whois.arin.net
    137|whois.arin.net
    138|whois.arin.net
    139|whois.arin.net
    140|whois.arin.net
    141|whois.ripe.net
    142|whois.arin.net
    143|whois.arin.net
    144|whois.arin.net
    145|whois.ripe.net
    146|whois.arin.net
    147|whois.arin.net
    148|whois.arin.net
    149|whois.arin.net
    150|whois.apnic.net
    151|whois.ripe.net
    152|whois.arin.net
    153|whois.apnic.net
    154|hois.afrinic.net
    155|whois.arin.net
    156|whois.arin.net
    157|whois.arin.net
    158|whois.arin.net
    159|whois.arin.net
    160|whois.arin.net
    161|whois.arin.net
    162|whois.arin.net
    163|whois.apnic.net
    164|whois.arin.net
    165|whois.arin.net
    166|whois.arin.net
    167|whois.arin.net
    168|whois.arin.net
    169|whois.arin.net
    170|whois.arin.net
    171|whois.apnic.net
    172|whois.arin.net
    173|whois.arin.net
    174|whois.arin.net
    175|whois.apnic.net
    176|whois.ripe.net
    177|hois.lacnic.net
    178|whois.ripe.net
    179|whois.arin.net
    180|whois.apnic.net
    181|hois.lacnic.net
    182|whois.apnic.net
    183|whois.apnic.net
    184|whois.arin.net
    185|whois.arin.net
    186|hois.lacnic.net
    187|hois.lacnic.net
    188|whois.ripe.net
    189|hois.lacnic.net
    190|hois.lacnic.net
    191|hois.lacnic.net
    192|whois.arin.net
    193|whois.ripe.net
    194|whois.ripe.net
    195|whois.ripe.net
    196|hois.afrinic.net
    197|hois.afrinic.net
    198|whois.arin.net
    199|whois.arin.net
    200|hois.lacnic.net
    201|hois.lacnic.net
    202|whois.apnic.net
    203|whois.apnic.net
    204|whois.arin.net
    205|whois.arin.net
    206|whois.arin.net
    207|whois.arin.net
    208|whois.arin.net
    209|whois.arin.net
    210|whois.apnic.net
    211|whois.apnic.net
    212|whois.ripe.net
    213|whois.ripe.net
    214|whois.arin.net
    215|whois.arin.net
    216|whois.arin.net
    217|whois.ripe.net
    218|whois.apnic.net
    219|whois.apnic.net
    220|whois.apnic.net
    221|whois.apnic.net
    222|whois.apnic.net
    223|whois.apnic.net
    224|whois.arin.net
    225|whois.arin.net
    226|whois.arin.net
    227|whois.arin.net
    228|whois.arin.net
    229|whois.arin.net
    230|whois.arin.net
    231|whois.arin.net
    232|whois.arin.net
    233|whois.arin.net
    234|whois.arin.net
    235|whois.arin.net
    236|whois.arin.net
    237|whois.arin.net
    238|whois.arin.net
    239|whois.arin.net
    240|whois.arin.net
    241|whois.arin.net
    242|whois.arin.net
    243|whois.arin.net
    244|whois.arin.net
    245|whois.arin.net
    246|whois.arin.net
    247|whois.arin.net
    248|whois.arin.net
    249|whois.arin.net
    250|whois.arin.net
    251|whois.arin.net
    252|whois.arin.net
    253|whois.arin.net
    254|whois.arin.net
    255|whois.arin.net

     

    Tuesday, July 26, 2011 6:33 PM
  • Thanks - any chance you can email it to me with the form etc - will make it a lot easier for me to try out
    Darren Rose
    • Edited by wingers Wednesday, July 27, 2011 11:27 AM
    Tuesday, July 26, 2011 7:07 PM
  • sorry but I'm inclined to say no for a couple of reasons:

    1. It's an app that I sell, sans source code of course

    2. Sending you the whole package won't teach you a thing.

    3. I'm new here and have no idea if sending complete code is frowned upon or not

     

    What I did post should be more than sufficient to get a working app in about 30 minutes.

    Here are the objects on the form

    Friend WithEvents btnLookup As System.Windows.Forms.Button
    Friend WithEvents BtnWhoisDomain As System.Windows.Forms.Button
    Friend WithEvents BtnWhoisIP As System.Windows.Forms.Button

    Friend WithEvents txtWhoisServer As System.Windows.Forms.TextBox - Not needed normally
    Friend WithEvents txtIPAddress As System.Windows.Forms.TextBox
    Friend WithEvents btnAbuse As System.Windows.Forms.Button  - not needed
    Friend WithEvents txtAbuse As System.Windows.Forms.TextBox - not needed
    Friend WithEvents txtDomain As System.Windows.Forms.TextBox
    Friend WithEvents txtResults As System.Windows.Forms.TextBox

    I'll EMail you a picture of the form

     

    Tuesday, July 26, 2011 11:01 PM
  • that's completely understandable - the screenshot will do fine

     

    Thanks


    Darren Rose
    Tuesday, July 26, 2011 11:03 PM
  • Should be in your inbox, let me know if you don't get it in the next few hours (while you sleep I assume)

     

    Tuesday, July 26, 2011 11:43 PM
  • Should be in your inbox, let me know if you don't get it in the next few hours (while you sleep I assume)

     


    Devon,

    It looks like you have a great product - it's not really my "cup of tea" as it were, but I know that I've seen others asking similar questions.

    If you have it as a .dll along with good help files on how to use it - I see no harm in posting a link to how others can get it. I'll bookmark the reference when I see others asking about it.

    Thanks



    EDIT

    That is - the pay version, I meant to add that and didn't.

    Tuesday, July 26, 2011 11:46 PM
  • Thanks again Devon - now have it working, just need to work out how to pull out just one line of information from the results - rather than listing it all - so I can just show who the ISP is
    Darren Rose
    Wednesday, July 27, 2011 7:30 PM
  • You may need to run several querys and see what the output is. It's not as simple as it seems. For instance,some querys nicely give you "OrgName:" but some don't, some just have something like "Road Runner HoldCo LLC RRWE (NET-76-80-0-0-1) 76.80.0.0 - 76.95.255.255"

    Why they differ I sure don't know

     

     

    Thursday, July 28, 2011 5:45 PM