Also are there tools that take a list of services on ports and map it to likely hardware/OS?
I have been programming for a long time but somehow I missed out on this kind of networking knowledge. Are most people who know this stuff network engineers?
IP addresses are assigned by regional internet registries[1] (RIR) like ARIN (for North America) and APNIC (for Asia-Pacific regions). Addresses are assigned in blocks like the /22 mentioned in the article.
These prefixes are then associated with Autonomous Systems, which participate in routing. You can view routing information on looking glass servers[2] or by using a tool like Hurricane Electric's BGP toolkit: http://bgp.he.net .
For example, here's the data for Cloudflare's AS (which serves HN): http://bgp.he.net/AS13335 . You can look at the prefixes it serves and who they peer with.
[1] https://en.wikipedia.org/wiki/Regional_Internet_registry
You're missing `whois`[1]. The wikipedia page is very informative.
If you give it an IP, it will give you "ownership" status of that particular IP, and then its containing netblocks ("outwards").
Example: (my favourite IP)
$ whois 5.9.6.9
% Information related to '5.9.6.0 - 5.9.6.31'
inetnum: 5.9.6.0 - 5.9.6.31
netname: HETZNER-RZ16
descr: Hetzner Online AG
descr: Datacenter 16
country: DE
--8<--
% Information related to '5.9.0.0/16AS24940'
route: 5.9.0.0/16
descr: HETZNER-RZ-FKS-BLK5
origin: AS24940
mnt-by: HOS-GUN
source: RIPE # Filtered
With a domain, it looks up the domain registration information.
If you ever script around whois, be prepared for loads of surprises, such as:
* Structure & format variations per provider (can be different on a TLD level)
* Some TLDs may not provide that information in a whois format at all:
$ whois test.gr
This TLD has no whois server, but you can access the whois database at
https://grweb.ics.forth.gr/whois_en.jsp
I am interested in how the databases that 'whois' queries are populated... the Wikipedia page looks like it will have some good pointers.
> We produce daily snapshots which are available to the public. You can find these files at our FTP site at: ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz
> or split by object type at: ftp://ftp.ripe.net/ripe/dbase/split
> These daily snapshots exclude the object types: person, role, organisation and mntner. For data protection reasons, personal data is not available in bulk format. [1]
To avoid confusion, that isn't just Europe (whose Regional Internet Register is RIPE NCC) but contains other continents/RIR data.
[1] https://www.ripe.net/data-tools/db/faq/faq-db/can-i-download...
As rid mentioned in his comment, this information comes from RIRs, who assign IP ranges to companies and other groups that request them. The WHOIS database is simply updated when an IP prefix is created or updated. When you make a WHOIS query, the RIR server is automatically contacted and the server simply returns a plaintext reply containing all the relevant information.
For example, ARIN (the North American registry) has a whois server for looking up data on IP addresses set up here: http://whois.arin.net
Nmap can scan and show the application and version based on various responses and req/response fingerprinting: http://nmap.org/book/vscan-examples.html
$ grep SSH /etc/services
ssh 22/tcp # SSH Remote Login Protocol
$ $ getent services ssh
ssh 22/tcp
$- Using an IP, netrange and information regarding the network owner (contact and abuse info). Gathered from the Regional Internet Registry (RIR) databases.
- Using a domain, registrant info --if public, abuse details etc..