Identifying malicious hosts

Whois is used to display ownership information for an IP address or domain name. A major use for this is to determine the source of requests appearing in the Smoothwall Firewall or Detection System logs. This can assist in the identification of malicious hosts.

1. On the SYSTEM menu, under the Diagnostics submenu, click Whois.
2. Enter an IP addresses or domain name for which you want to find out ownership information.
3. Click Run. The output of Whois, is as it would be, if it were run directly by the root user from the console of the Smoothwall.