On Thu, 11 Mar 1999, Jeff Weisberg wrote:
| > Does anyone have a script that takes a list of IP addresses, looks | > them up in whois, and mails the contact for them and tells them | > they're a smurf amp (with appropriate pointers to self-help files, | > etc)? The enclosed hack worked last time I tried it (but no garuntees). Change occurances of OpNet/op.net to your own name. #!/usr/local/bin/perl [snip] open(W, "whois -h whois.arin.net $net |");
Ok, that does fine for machines whose authoritive whois record is within the ARIN whois database, but what about the other two thirds of the globe, namely RIPE (Europe) and APNIC (Asia-Pacific) ? Congratulations, you've just emailed either 'nicdb@ripe.net' or 'sysadm@apnic.net' blaming one of the IP registries for running (in this case) a smurf amplifier. Please, go and track down the ipw script, its better than nothing as it does have some knowledge of which whois server to query. That way, you won't get the ever-so-nicely worded response which basically says 'Ahem. Go query our whois server for the *correct* information.'. --==-- Bruce.