#!/usr/local/bin/perl
######################################################################################################
# The IP to City resolution script. This is a neat script that permits you to resolve IP addresses   #
# in your Web Logs to a postal address. This is sone by querying the whois database in the US, Europe#
# and the Asia Pacific region. The resulting information is then stored in a database. Currently the #
# database we use is Oracle. However this can be ported to otehr databses too.                       #
# This script was authored by Deepak Ramanathan at the Northeast Parallel Architectures Center at    #
# Syracuse University										     #
# You can email me for comments and suggestions at deepak@npac.syr.edu				     #	
######################################################################################################


	$out = 'resolved.dat';
	$in = 'stripaccess.log';
	@iparr;
	
	&getIptoArr();
	open(Data,"<$in") || die "Curses I have been shot";
	open(Datafile,">>$out");
	while ($line = <Data>) {
	($remote, $dash1, $dash2, $date, $tz,$method, $page, $protocol, 
	$protnum1, $size) = split(/\s/,$line);
	$strip = $remote;
	$strip =~ s/.*\.//g; # Am now stripping the I.P  
	$remote = &GetIPtoDomain($remote) if ($strip =~ /[0-9].*/);
	
	}
    
    sub GetIPtoDomain {
	local($ip) = @_;
	$aip = $ip;
	$present = 0;
   foreach $e (@iparr) {
	if($ip =~ /$e/){$present = 1;last;}
    }

if($present == 0) { 
	push(@iparr,$ip);
	
	if($ip =~ /(\d+\.\d+\.\d+\.\d+)/) {
  $ip = $1;
	}
    $cmd = "./whois -h whois.arin.net \"full $ip\"";
	$done = 0;
	while($done == 0) {
    	   @arr = split(/\n\n/,`$cmd`);
    	   $first = $arr[0];
	   if ($first =~ /European Regional/i) {
		$cmd = "./whois -h whois.ripe.net $ip";
		$op = `$cmd`;
		@arr = '';
	      @arr = split(/\n/,$op);
		foreach $i (@arr) {
		if($i =~ /descr:\t*(.*)/) {
                    $desc .= $1;
                 }elsif
		($i =~ /address:\t*(.*)/){
		$address .= $1;
              }

}
             $desc =~ s/\s+/ /g;
             $address =~ s/\s+/ /g;
	      print Datafile "$ip\t$desc\n$address\n\n" || die "I cant open it Captain";
		$desc = '';
		$address = '';
		$done =1;
           }	
		elsif 
		($first=~ /Asia Pacific/i) {	
		$cmd = "./whois -h whois.apnic.net $ip";
		$asia = `$cmd`;
		@arr = split(/\n/,$asia);
		foreach $i (@arr) {
		if($i =~ /descr:\t*(.*)/) {
		$descasia .= $1;
		} elsif
		($i =~ /address:\t*(.*)/){ 
		$addressasia .= $1;
	}
		elsif
		($i =~ /country:\t*(.*)/){
		$countryasia .= $1;
	}
}
	$addressasia =~ s/\s+/ /g;
	$descasia =~ s/\s+/ /g;
	$countryasia =~ s/\s+/ /g;
	print Datafile "$ip\t$descasia\n$addressasia\s$countryasia\n\n";
	$descasia = '';
	$addressasia = '';
	$countryasia = '';
	$done=1;

	}
	else {
        print Datafile "$ip\t$first\n\n" || die "I cant open it Captain"; 
        $done = 1;
}
           last if($ip == '');
	}
	}
}
	sub getIptoArr {
	open(R,"<$out");
	while($p = <R>) {
	if($p =~ /^\d\d\d*/) {
	($ip,$junk) = split(/\t/, $p);
    push(@iparr, $ip);
	  }
      }
  
  close(R);
}
