IP address lookup
Someone recently asked me how to get the physical location of an IP address. One of the better (free) services available on the Internet is the IP2Location (demo) service.
This feature might come handy if you're trying to figure out who's attacking your application servers (when the TCP session has already been established). Denial-of-service attacks commonly use fake source IP addresses.
A) Spoofing their address, in which case the location information will be wrong; or
B) Using a botnet, in which case the location you get will be that of the bot, and not the actual attacker.
(B) Most of the attacks I see in various server logs don't come from bots, but from script kiddies or someone downloading the whole web site content and overloading the server in the process. In both cases the IP address makes sense.
@Freelancer: Correct. The location reported is whatever the ISP has entered in some database as the location for a particular IP address block. In some cases, it's the ISP's location, in other cases the ISP might have split the address range into regional blocks and registered them properly.
implementation , where on the perimeter there is
a simple layer 3 packet filter IPtables based FW
that filters out unwanted traffic and thus lowers
logs clutter/IPS load/management burden.
http://www.securityfocus.com/infocus/1900
Thanks!