I have the top 10 IPs making the most requests and the number of requests made from an Apache log file. I used this command to handle a request:

cat access_log|cut -d' ' -f1|uniq -c|sort -r|head -n 10

I need to do the same, but also find the owners of these IP addresses.

  • 2
    Please define owner of IP address. – Cyrus Dec 7 '15 at 11:26

You can extend your command to lookup the IP addresses against whois information:

cat access_log|cut -d' ' -f1|uniq -c|sort -r|head -n 10|while read COUNT IP; do whois $IP; done;

To find the owners of IP addresses, you have the whois and geoiplookup commands. Whois gives you the organization, geoiplookup translates any IP address to country, and approximate geographic location.

Such commands are used as:

GeoIP Country Edition: CN, China
GeoIP City Edition, Rev 1: CN, N/A, N/A, N/A, N/A, 35.000000, 105.000000, 0, 0

% [whois.apnic.net]
% Whois data copyright terms                 

% Information related to ' -'

inetnum: -
netname:        CHINANET-GD
descr:          CHINANET Guangdong province network
descr:          Data Communication Division
descr:          China Telecom
country:        CN

I usually find more useful to know the country when in the top of requests, and the actual organisation only if investigating a particular problem.

I would change your command as:

for i in `cat access_log|cut -d' ' -f1|uniq -c|sort -r|head -n 10`
    geoiplookup $i | head -1 | awk ' { print $4 } '

To install the required commands in Debian do:

sudo apt-get install geoip-bin whois

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.