Determining ISP from an IP address

I know that this is a newbie question that's probably been asked before, but I tried doing searches on this site and couldn't find anything.

I also tried searching on Google, and all I found were some sites that had some utilities to download to find this information out. However, I'm not about to just start downloading and installing any application, so I thought I'd post a message here. Does anyone know of a good app/utility/website to find this info out? My firewall's going nuts reporting this one IP address scanning like every port on my machine, and I wanna find out who it is and report him. Thanks.

www.samspade.org

Ammo

i get the same thing at least 26 alertts in 1 or 2 seconds and i found out by whois that it was scannerabuse.blueyonder.co.uk which
is my isp is this normal u r isp running porty scans on u r box oh yea try what ammo said :)

prodikal: what port?

Ammo

sweet!!! thanks for the tip!

prodikal id send them a copy of the log just incase somebody hi-jacked their server.

Well, Some ISP's tend to ping users on its network to see if the connection is still live. But 26 in 2 seconds isn't normal. Sounds like someone did a scan on you.

As far as finding out what ips are associated with which I always use ARIN located at http://www.arin.net/whois/arinwhois.html


Or do a search for "WHOIS" on google and you can find many more.

ammo the ports are 50734. 6588. 50735 .1080. 50736. 50736. 50812
6588.50813.50814.50815.50875.6588.50876.50877.50878.50946.50947
6588.50948.50949.51013.51014.6588.51015.51016.51076.51077.51078
51079.37358
im not really worried about it but does u r isp usually port scan u r box is this normall behaviour

Well, do to the fact that some of the ports are sequential it looks like someone scanning. You did say this was in 1 or 2 seconds right?

Normally if an ISP does ping you its just a random high number port, but only once in a while, and not in a sequential pattern like this. I would notify it to the Admin of the network. Its kinda strange.

yes xmaddness the first alert shows and the counter just keeps riseing when i went 2 whois it said it was scannerabuse.blueyonder.co.uk
does scanner abuse mean anything 2 any 1 ? any feed back would be great thanx for u r help allready much apprecciated