CESNET / NERD

Network Entity Reputation Database

Home Page:https://nerd.cesnet.cz/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Hostname tagging - recognition of IP encoded in hostname

vaclavbartos opened this issue · comments

Add new functionality to HostnameClass module - find out if the hostname was derived from the corresponding IP address, i.e. if the IP (or part of it) is somehow encoded into the hostname. For example, the followng situations should be recognized:

100.33.130.194 | pool-100-33-130-194.nycmny.fios.verizon.net
195.62.53.135 | 53-135.static.spheral.ru
81.214.186.168 | 81.214.186.168.dynamic.ttnet.com.tr
103.57.134.203 | 203.134.57.103-in-addr.arpa-hireachdns.com
203.192.236.35 | dhcp-192-236-35.in2cable.com
46.107.91.149 | 2E6B5B95.dsl.pool.telekom.hu

The task is:

  • Find out various formats being commonly used.
  • Prepare a regexp (or s set of regexps) to match all those formats.
  • Modify HostnameClass module to assign tag ip_in_hostname if IP is found in hostname (possibly with confidence < 1, if there are some formats where it's not completely clear that the hosname was derived from IP, but I don't expect this).

Closing ages old issues (this is already done).