如何将 IP 地址解析为组织（使用缓存）
我想从 IP 地址分配注册表中将 IP(v4) 地址解析为所有者组织。为此，我不想成为 whois 协议和模板或注册管理机构本身结构方面的专家。我只想要一个接受 IP 地址（分配在世界任何地方）并返回一个短字符串（如“IBM Corporation”）的函数。通过输入“whois nnnn”并观察结果，我会发现同样的事情。反向 DNS 不是我想要的。应该是免费软件并在 Linux 上运行。
令我难以置信的是，我找不到这个。 whois 程序（在 Debian 上）和其他面向用户的前端为我提供任何 IP 地址的结果，但采用各种原始格式。我找到了解析结果的 whois 库，但他们似乎假设我是 whois 专家并且知道哪个注册表包含我的查询记录。我认为只需要将各个部分组合在一起，但似乎没有人做到这一点。我是否错过了什么，或者事情比我想象的要容易？
作为奖励，我想维护这些查找的缓存。缓存应存储 whois 结果的网络范围，以便它返回同一网络中另一个 IP 地址的命中。理想情况下，随着缓存的增长，缓存的性能应该比线性搜索更好。
目的？我发现这对于分析服务器日志非常有帮助。如今，反向 DNS 几乎毫无用处，但我仍然想知道谁负责请求。
I would like to resolve IP(v4) addresses to owner organizations, from the registry of IP address allocations. To do it, I don't want to become an expert in whois protocols and templates or the structure of the registries themselves. I just want a function that takes an IP address (allocated anywhere in the world) and returns a short string like "IBM Corporation". The same thing I would find by typing "whois n.n.n.n" and eyeballing the result. Reverse DNS is not what I want. Should be free software and run on Linux.
Incredibly to me, I can't find this. The whois program (on Debian) and other user-oriented front-ends give me a result for any IP address, but in all sorts of raw formats. I've found whois libraries that parse results, but they seem to assume I'm a whois expert and know which registry has the records for my query. I think the pieces just need to be put together, but nobody seems to have done it. Have I missed something, or is it easier than I think?
As a bonus, I would like to maintain a cache of these lookups. The cache should store the network range for whois results so that it returns a hit for another IP address in the same network. Ideally, the cache should perform better than a linear search as it grows.
The purpose? I would find this incredibly helpful for analyzing server logs. Reverse DNS is mostly useless thse days, but I would still like some idea of who's responsibly for requests.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我想我找到了解决这个问题的更好方法。我错误地认为反向 DNS 毫无用处：反向 DNS 的作用比我知道的更多！例如，给定IP地址
8.12.3.96，没有96.3.12.8.in-addr.arpa的PTR记录：但我刚刚了解到您可以查询
3.12.8.in-addr.arpa的委托记录：信息非常丰富！我们可以查找通用后缀并将该地址与
textdrive.com域关联起来。我知道这一点是因为 jdresolve 做到了（使用
--recursive选项）。并且它可以缓存。这似乎是分析网络日志的绝佳工具，以巧妙且创新的方式来解析“无法解析”的 IP 地址。它完成了我尝试使用 WHOIS 完成的同样的事情。I think I found a better approach to this problem. I was wrong to think that reverse DNS is useless: there is more to reverse DNS than I knew! For example, given the IP address
8.12.3.96, there is no PTR record for96.3.12.8.in-addr.arpa:But I just learned that you can query the delegation records for
3.12.8.in-addr.arpa:Pretty informative! We can look for the common suffix and associate the address with the
textdrive.comdomain.I know this because jdresolve does it (with the
--recursiveoption). And it can cache. This seems to be a great tool for analyzing network logs, with a clever and innovative way to resolve "unresolvable" IP addresses. It accomplishes the same thing I was trying to do using WHOIS.whois 信息没有真正的固定格式。您必须解析数据并做出猜测。我建议寻找
OrgName:、Organization:、Organization:，可能还有很多其他的。如果您只是为自己的网站执行此操作，我建议使用 Analytics 包来为您执行此工作。 Google Analytics 很棒，但不会分析您的网络服务器日志。您必须使用诸如网络趋势之类的东西。
There is no real set format for whois information. You will have to parse through the data and make guesses. I suggest looking for
OrgName:,Organisation:,Organization:, and there are probably plenty of others.If you are just doing this for your own sites, I recommend using an Analytics package to do this work for you. Google Analytics is great but does not analyze your web server's logs. You would have to use something like Web Trends.
我的服务 http://ipinfo.io 提供 API 返回公司名称作为组织字段：
您可以只获取该字段通过将 /org 添加到 URL：
添加您自己的客户端缓存应该不会太棘手。您可以在 http://ipinfo.io/developers 找到有关 API 的更多详细信息。
My service http://ipinfo.io offers an API returns the company name as the org field:
You can get just that field by adding /org to the URL:
Adding your own client-side caching shouldn't be too tricky. You can find out more details about the API at http://ipinfo.io/developers.
正如布拉德在他的回答中正确指出的那样，没有标准，也没有办法检测所有响应的相同信息。
您需要为每种响应格式创建一个解析器，这需要付出巨大的努力。
一年前，我开始了创建纯 ruby WHOIS 客户端和解析器的项目。
该库是开源的，因此请随意分叉并回馈。
目前它提供了超过 150 个不同的解析器。并非所有解析器都支持组织信息，但该库具有非常灵活的 DSL，因此您可以轻松添加它。
As Brad correctly pointed out in his answer, there is no standard, no way to detect the same information for all responses.
You need to create one parser for each response format, and it requires a really huge effort.
One year ago I started the project of creating a pure-ruby WHOIS client and parser.
The library is open-source, so feel free to fork it and contribute back.
Currently it provides more than 150 different parsers. Not all parsers support the Organization information, but the library has a very flexible DSL so you can easily add it.