Using ACID

197

6.3.5

Searching whois Databases

To get whois information about a particular address, you can click on any address

and select a particular whois database, like American Registry for Internet Numbers

(ARIN) at http://www.arin.net. The response to such a query for IP address

66.236.16.52 is shown in Figure 6 11.

This information is very important for incident response. This is usually the first

step to finding out the owner of the attacking IP address and his/her contact number.

After finding this information, you can contact the owner to stop bad guys from probing

your network.

Figure 6 11 

Response to whois query.