On Jun 17, 2012, at 9:39 AM, joseph.snyder@gmail.com wrote:
It's about time and cost. If it's an emergency situation, trying to guess who might own the address waste time to get confirmation, if it is a complete guessing game. Then a warrant has to be gotten. You need to know who to put on the warrant to make a request.
Exactly. If you start with an IP address and you're trying to get to some real-world entity, then you can check routing of the block or the Whois entry... this will get your to an ISP, but then you get to repeat the process by contacting that ISP and repeating the query (and potentially again if their customer is an even smaller ISP or hosting firm, etc.) With reasonable Whois update practices, Whois will get you to the ultimate non-residential organization much faster (which can make a difference in many situations.) The entire process can be pursued via contacting ISPs serially and asking them to check their routing and customer records, but that approach is definitely slower and far most costly for both government and industry. FYI, /John John Curran President and CEO ARIN