Why use Network Details?
A remote IP address alone tells you very little. Network Details helps answer practical questions such as who operates this network, how large is the network range, and who can I contact if the traffic is unwanted or questionable?
WhoIsConnected can show where an application connects. Network registration information can provide additional clues for investigation, although it does not necessarily explain why the application uses that connection.
WhoIsConnected Principle
When you do not understand a connection, investigate it before deciding whether you want to allow it. Network Details provides information that can help you make that decision.
Information Provided
Depending on publicly available registration data, Network Details can include:
| Field | Why it is useful |
|---|---|
| Country | Shows the registered geographical location of the network. |
| Network Name | Identifies the name associated with the network provider. |
| Organisation | Identifies the organisation responsible for the registered network. |
| Technical Contact | Provides technical contact information when available. |
| Abuse Contact | Provides a contact that may be used to report suspected spam, malware or other abuse. |
Understanding IP Addresses and Network Ranges
| Concept | Example | Meaning |
|---|---|---|
| IPv4 address | 203.0.113.45 | An individual IPv4 address. |
| IPv6 address | 2001:db8::1234 | An individual IPv6 address. |
| Network range | 203.0.113.0/24 | A CIDR range covering a group of related addresses. |
Understanding Network Size
The number after the slash (/) is the CIDR prefix length. In general, the smaller the number, the larger the network range. CIDR notation can also represent a single address: IPv4 /32 and IPv6 /128 each represent one address.
| IPv4 CIDR | IP addresses covered | What this means when blocking |
|---|---|---|
/32 | 1 | Blocks one IP address. |
/24 | 256 | Blocks a range of 256 IP addresses. |
/16 | 65,536 | Blocks a large range of IP addresses. |
/8 | 16,777,216 | Blocks a very large range of IP addresses. |
Why does this matter? When you block a network range, you block communication with all IP addresses covered by that range, not only the IP address currently used by the application. A broader network block can be useful when an application changes between IP addresses within the same range, but it can also affect other destinations in that range.
IPv6 follows the same principle. /128 represents one IPv6 address; smaller prefix values represent increasingly larger ranges.
Using the Information
If a connection is unexplained, compare the application with the network owner and registration information. If you choose to block an IP address or range, continue using the application and observe the result. If a function you need stops working, you can reconsider the block.
The organisation operating a network provides the infrastructure carrying the communication; it does not necessarily own or control every application or service using that network.