User login

MetaTraffic 2.0 Boxshot

"IP Address" vs "Remote Host"

Posted by Daniel [August 16, 2003]

Good day,

After consulting few records of the database, roughly 21000, I noticed that the "IP Address" and "Remote Host" address were always exactly the same.

Unless there is a way via scripting to get the workstation's IP address when it is behind a firewall or is actually sharing an internet connection (which I wasn't successfull at finding so far), I'm not seeing the real use of keep both pieces of information.

Could someone tell me if there is a potential use/need to keep both of them, or if removing the "Remote Host" IP address is something that can be done without jeopardizing the whole reporting aspect of the product.

Best Regards.

"IP Address" vs "Remote Host"

If reverse DNS lookup is enabled on the server, thr remote host field contains the visitor's domain name.

"IP Address" vs "Remote Host"

Good day,

By design, "Reverse DNS Lookup" could potentially degrade server's performance, so I doubt web hosting services would enable that kind of functionality, specially under a shared environement.

For instance, the server where one of the sites I worked on is actually sharing the same server for roughly 470 sites.

Even though not all of them will issue a Request.ServerVariables("REMOTE_HOST") at the same time, whoever does will probably impact the other sites turnaround, not by much, but it adds up.

It sure would be a nice to have, however performance wise it seems to be a tad costly. There are even warnings issued suggesting to make sure an evaluation is done under a test environement prior to implement the functionality on a production environment.

There must be a way to somehow get that information by other ways. With the industrial amounts of DLLs that are composing an IIS environment, I can hardly believe it can't be done without having to install a 3rd party component, which is even more difficult to get installed by web hosting services.

Let's face the facts, if "Reverse DNS Lookup" can be enabled/disabled at will, there must be an object somewhere that can be used to get that information, or are we facing another M$ "behavior by design" stupidity!:twisted:

Regards.

"IP Address" vs "Remote Host"

Every method I've seen that did not require server-enabled reverse-DNS used a component. I've never seen a script version of Reverse-DNS.

I have seen log parsers that did the DNS lookup as the log file was analyzed, and I suppose Chad could do the same thing in v2.0 if he chooses to implement a log table that is parsed to the information table summaries (much as you have done in your small-DB version), but he (or we) might need to find a script-only version of reverse-DNS lookup [my but isn't this an impressively-long sentance].

I think you might need to be in the hit-per-second category to notice server performance degradation, but with 470 other user, I'm sure you beat that by a long stretch.

"IP Address" vs "Remote Host"

Good day,

You're right, all the reverse DNS lookup things I found so far are using a component, with the exception of one.

I found a script, that doesn't use a component at this link : [url]http://www.asp101.com/articles/jason/reversedns/default.asp[/url]

However, that approach uses the CreateObject("Wscript.Shell") which has a very limited scope of action if you're not part of either the Administrators or Operators groups on the IIS server.

As if this wasn't enough, the script calls the NsLookup program from the server, re-directs the stdout to a file, reads the resulting file using the Scripting.FileSystemObject, then delete the file after the work is done.

The fellow who wrote the article, starts with the sentence : "Many people fail to realize the full power of ASP". If having to do all that gymnastic is necessary to get the same information as a "simple" component, I'm tempted to believe that the writer's statement is somehow biased. ;)

Resolving the DNS at the time the reports are generated is not quite the approach I'm looking for.

Based on some tests I did locally, when I did resolve the addresses at reporting-time, it induced an average of 40ms to 100ms delay per entry. If I have 25 entries listed on a given report page, I would be looking at rather substantial amount of time, estimating that at any point of time there will be 20%-40% of the sites, hosted on the same server, that will issue/receive a request of some sort.

Programs like WebTrends are using multi-threads to achieve a better performance when doing reverse lookup, however it generates a set of static html files, so that the reports can be consulted back and forth without having to redo the reverse lookup. Also, the stats generated by WebTrends (not to be confused with WebTrends Live), may be ran periodically, such as once daily for instance. If it is being held responsible to perform the reverse lookup, the odds to have quite a few of theses addresses offline are pretty good, therefore implying unresolved addresses at reporting time.

What I may end up by doing is gradually building a reference table with IP addresses ranges. Knowing that some sets/subsets are assigned to specific ISPs, resolving one of a given range will be sufficient enough to "extrapolate" the others part of the same preset scope.

The main task will be to compile these ranges, but having access to the ARIN WhoIs facility, this process can be done via code, therefore I can gradually built a DNS lookup table at a smooth/decent pace.

In the same line of thoughts, a number of days can be set for the life of a given set, thus forcing a new reverse DNS lookup to refresh the table at a preset interval.

Using a customized self-updated reverse DNS lookup table, alleviates the need to use any components and I wouldn't have to bug the hosting service to enable the facility on IIS. Plus, the overall functionality will always be there, regardless where the site is hosted, would that be a free or paid-for hosting service.

Anybody has comments/suggestions on that ?

Bye for now...

"IP Address" vs "Remote Host"

I assume you mean using http requests to retrieve information from Arin? The problem with this is that Arin has an acceptable use policy that prohibits this kind of thing. (I don't blame them; most other sites have similar policies.)

Another way to do this would be to use asp.net with the system.net namespace and the GetHostByAddress method. A lot of web hosts have .net capabilities. It might be tricky to integrate with classic asp but it could be made to work.

~Chad

"IP Address" vs "Remote Host"

Good day,

You're right about the usage policy thing and this is one of the reason why I said "...at a smooth/decent pace".

I dunno about the integration with asp.net, to be honest with you, I don't know much more about asp.net that the name itself. :oops:

I understand that eventually "ASP classic" will be somehow less popular, but for the moment being, this is the only one I feel confortable with.

I think "integration" could be somehow achieved, even if dealing with 2 different hosting services. I had in mind an approach similar to the IPN (Instant Payment Notification) process used by PayPal. I would send an IP address, with some additional information to be able to get to the proper record, then the "other server" would resolve and return the "Reverse DNS lookup" name, pointing to a page that would invoke an update process in the background.

It may sounds like a lot, simply to get a host name, however I think that may be a worthwhile exercise, and the concept could be applied to other uses later on.

Keeping in mind the timespan of a given range as mentioned in my previous message, It would be possible to minimize the actual servers requests to a minimal amount.

There are few free ASP.NET web hosting site, so even if they have advertising, that doesn't really matter, since everyhing will be done behind the scene.

Btw, I suggested to my web hosting service to enable the "Reverse DNS Lookup", only on my site, and they aggreed. :D

However, since there is always a "BUT", the resolved name is now showing under the "c-ip" column in the IIS log. A tad confusing. I'll check if there is a way to get both the IP and the resolved name in the log.

Anyhow I was planning to have the "c-computername" removed, since the odds to actually be able to gather this information from a computer connected via the internet, is rather slim, due to the proxy, and different security levels. By removing that field, I would compensate a part of the extra time required for the lookup.

In another line of thoughts, I'm now having 22286 records in the DB, and it is still under the 5 MB mark. It will increase a bit when I will put the "REMOTE_HOST" thing back in place, but should be able to keep a fairly decent overall "Records per MB" ratio.

Regards,