fredag 22 februari 2013

How many ISP:s are you using?

This one requires some basic programming skills but python is easy to learn so lets get going.
GeoIP can produce more than just countries, but the support for ASN is a little bit tricky since the normal binary GeoIP module is quite old even in Ubuntu 12.04.
That is why we will use the pythonbased one that is much slower instead, this matters if you want to map thousands of ipadresses.
First install install the latest module by issuing:
sudo pip install pygeoip
Download http://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz from the maxmind homepage, extract it and put it among the others.

Start up the python interpeter.
import pygeoip
_ipaddr="198.101.241.245"
gia = pygeoip.GeoIP('/usr/share/GeoIP/GeoIPASNum.dat')
_asn = gia.org_by_addr(_ipaddr)

print _asn

Ok now parse your favourite logs for ipadresses an map how many ISP:s which users are using....
Which combinations seems to unlikely to be true?
Which ISP do you find to be least trusworthy?


Inga kommentarer:

Skicka en kommentar