mapped networks?

i was looking into how doubleclick works for school and i found a good explanation on their site, but i dont understand this part of it:

Quote:

---

The user's IP address is referenced, and the series of numbers that make up a user's network address (ex. 199.25.206.5) is noted. These Network addresses are referenced against the DART server's database of more than 400,000 mapped networks.

Each mapped network reveals the user's Domain (att.net, Microsoft.com, etc.), and the following information about that Domain: Country, and in the U.S and Canada -State, Postal Code, Area Code and SIC Code.
Note: Use of the user's IP address allows more targeting than with top-level domain alone (i.e .com). Regional targeting features and SIC code targeting will also be made available in International markets in the future.

---

particularly what is a mapped network(in this instance)

and

what they mean by "Note: Use of the user's IP address allows more targeting than with top-level domain alone (i.e .com)". what would be the point of identifying an ip address only by it's third level domain: .com, .org, etc. ? also, by domain do they mean like, if i have a domain name setup in a dns to point to my ip address they see that or what do they mean?

Quote:

---

particularly what is a mapped network(in this instance)

---

generally speaking a mapped network is one in which someone has taken the time to create a layout (visios is a great program for this, but time consuming) of all routers/switches/hubs on the network and some times each node if you are doing a small netowork. In my compnay we have a network map for every client we take on. so if anything ever breaks we can pull out a map and see where the problem is occuring if its a routing issue or a connectivity issue. Basicly its a quick refrence.

Quote:

---

what they mean by "Note: Use of the user's IP address allows more targeting than with top-level domain alone (i.e .com)". what would be the point of identifying an ip address only by it's third level domain: .com, .org, etc. ? also, by domain do they mean like, if i have a domain name setup in a dns to point to my ip address they see that or what do they mean?

---

they mean that if they do a trace by just the url they cant get as much info as if they do it by IP. When you go by ip addres you can get a physical location or general location on where the server is. Most of the time to trace by domain name the tracer will resolve the ip and trace that. but ip is more specific anyhow, it can also give you info as to if they are running a netowkr off that IP or if it is just a box on the net etc. And yes, they mean if you have a domain set up by someone they trace that, they dont mean domain in the sense of saw a windows enviroment spit into domains.

for the domain thing: for example i'm hosting a web page and my isp is comcast, they'd have my ip, but would they see the domain i have setup with my dns, or would they see this: c-24-112-142-212.abc1.ny.comcast.net thats foobared by the way, even though this page prolly logs my ip anyway. for some reason a "ping -a" on my own ip resolves to something like that and not my domain name that i have setup. i was thinking maybe having another domain show up might hide your isp from something like doubleclick.

also, i didnt realize that the map of an isp's network was public knowledge, i guess it cant be that accurate since ips change pretty frequently, but they can still get down to which regions use certain octets?

they would see what ever ip your domain naim resolves to. if you ping www.google.com you will get a reply from the IP address that it resolves to (in googles case and in many others the ip will change becasue they have tons of IP addresses for that one domain name)

for the mapping, they probably are not detailed maps at all. running a tracert is a very generic way to map a network becasue it shows you the hops between two points. The regions arent top secret and can be guessed by looking at the ranges the company owns and then looking at what some of their customers have. In my state I can tell who has which ISP just by looking at their IP addresses. of course my state is tiny and there is a very small selecting, but places like arin.net have a lot of data about stuff like that and can generally trace the IP.

well, for the ping question: i have a domain name set up to resolve to my ip address(which is pretty static). if i do a "ping -a 24.112.142.212" which is a ping to my own address that is supposed to resolve that ip to it's domain name, it will show whatever domain comcast has given my ip:"c-24-112-142-212.abc1.ny.comcast.net" and not the domain name that i have set up for it. i was just wondering why.

Slinky: Do yourself a favor and edit you post to hide the IP address..... Never post a static IP address without obfuscating it first....

I dont think that is his real IP address. He said he is running a web server off of it and arin turns up nothing about that IP aside from that it belongs to rogers high speed internet in canada. That and you cannot telnet to port 80. so it could just be offline, im thinking thats the wrong IP address.

Quote:

---

c-24-112-142-212.abc1.ny.comcast.net thats foobared by the way

---

anybody have an answer to my question?

Quote:

---

well, for the ping question: i have a domain name set up to resolve to my ip address(which is pretty static). if i do a "ping -a 24.112.142.212" which is a ping to my own address that is supposed to resolve that ip to it's domain name, it will show whatever domain comcast has given my ip:"c-24-112-142-212.abc1.ny.comcast.net" and not the domain name that i have set up for it. i was just wondering why.

---

Simple.... Because Comcast owns the netblock and have authoritative servers for it... You can call your computer anything you like but Comcast's resolution will _always_ trump yours...

Questions?

thanx shark ;)

I had a question related to this matter. When you ping or run a trace on someone's IP/domain name, is their box, domain, or AV alerted to such activity immediately or logged in somewhere were they can check later to see if such activity has taken place? And if so, does that information provide the actual IP address of who is probbing them and where is that information stored?

I am guessing yes, because I think I vaguely recall warnings from my own AV years ago. long before I had a clue about, much less knew I wanted to get into security, that went something to the effect of "echo request ping 123.456.78.9" or "ping echo request 123.456.78.9" or something to that effeect. Again, that was years ago and long before I had any interest in security, I wouldn't have really known what was happening other than an intrusion detection warning. And again, I very vaguely remember this, so I could be confusing and mixing this with a couple other warnings I remember from that time. I don't recall any such warnings since and if I knew for sure I wouldn't be posting.

And how likely is such activty liable to cause the target to take some sort of action against you, if they are up to speed? Or are they just going to think, Hmmm, I been probbed, unless further action results from it?

And if your actual IP address is shown, what can you do to hide it while running a ping/tracert?

The reason I am asking this is for one, to build my knowledge, and two, I went out wardriving about a week and a half ago, for about a week and a half, just using netstumbler and was following up on the signals I gathered to see what I could learn myself from it and noticed some IP addresses under the subnet category and was trying to verify if they were in fact their actual IP addresses or not, or if they were even actual IP addresses, cause some pings resulted in nothing at all.

But, I wanted to know before running any further pings/tracerts and before I piss someone off, and so I don't skyline myself, as well :D