Jon Evans - Dark Places

"So are we meditating before we begin or what?" she asked.

"Um, yeah. Just planning," I lied, inserting the disk. "I warn you, this could take a while and will probably be very boring."

"That's okay. Just keep me informed about what you're doing. And use English words and no acronyms."

"I see you have dealt with my kind before."

"More than the amount necessary to have a full and happy life."

"Very funny. Well, the first thing I'm doing is checking for the exact time that Mr. BC088269 posted to the Thorn Tree." I went on the Web, logged in to the Thorn Tree, scrolled down to his message. "6:01 on November 4. I'm going to assume that the web servers are using the same time zone as your database server — "

"They are," she said.

"Okay. Next we look at the log files." I opened them up in UltraEdit. Each one consisted of hundreds of thousands of rows of text, each row a long stream of data unintelligible to anyone uninitiated in the secrets of my field:

64.76.56.49, 11/4/00, 0:00:19, ARMSTRONG, 64.211.224.135, 2110,

438, 22573, 200, GET, /dest/

206.47.24.62, 11/4/00, 0:00:19, COOK, 64.211.224.135, 109, 502,

32090, 200, GET, /prop/booklist. html

129.82.46.82, 11/4/00, 0:00:21, MAGELLAN, 64.211.24.142, 78, 477,

11505, 200, GET, /cgi-bin/search

206.47.244.62, 11/4/00, 0:00:23, MAGELLAN, 64.211.224.135, 0, 567,

28072, 304, GET, /dest/europe/UK/London. html

… and so forth and so forth, one for every time anybody looked at a Lonely Planet web page that day.

"And this means something to you?" she asked.

"It does."

"What does it mean?"

"Well… each line represents one request. One page that some user out there wants served to them. And each line tells me the IP number of the user's computer, the date and time, the server computer name, the IP number served, how much time the whole request took, how many characters the user sent, how many characters the server sent, whether it all completed successfully, whether the user was getting or sending information, and the page they wanted."

"Uh-huh. And this is useful?"

"Maybe. First of all let's get all this into Excel. Text is hard to work with." I called up Microsoft Excel and ran its import wizard on the four log files, turning them into malleable spreadsheets, which I cut-and-pasted together into a single file. A very large file.

"You guys are popular," I observed. I sent an impressed look over my shoulder and met those electric blue eyes again.

"A million hits a day," she said proudly.

"Right," I said briskly, making my head swivel back towards the computer. "Yeah. One point two three million on November 4. Good thing I've got a monster machine here or this would take forever. Okay. Yeah. All right, first thing, let's get rid of everything that isn't within a two-minute window when that message appeared." I sorted the entries by date and wiped everything except those between 6:00 and 6:02. This reduced things to a manageable 2200 hits. "Next, let's get rid of everyone looking at your main site instead of the Thorn Tree." I pinged thorntree. lonelyplanet. com, found out that it was 64.211.24.142, and got rid of all requests to different servers.

"That's still two hundred-odd possibilities," she said. "I thought you'd actually be able to look at the messages they posted."

"No such luck. But we're not done yet. Anyone actually posting a message would use an HTTP POST method, not a GET, you use GET if you're just reading." I eliminated all the GETS, and this reduced the spreadsheet to only three rows:

116.64.39.4, 11/4/00, 0:06:01, MAGELLAN, 64.211.24.142, 3140,

9338, 32473, 200, POST, /cgi-bin/post

187.209.251.38, 11/4/00, 0:06:01, COOK, 64.211.24.142, 2596, 1802,

31090, 200, POST, /cgi-bin/post

109.64.109.187, 11/4/00, 0:06:01, HEYERDAHL, 64.211.24.142, 0,

2847, 72, 500, POST, /cgi-bin/post

"Easier than I thought," I said.

"So we've got three possibilities?"

"Actually, no. See that 500 on the last line?" I pointed it out. "This means that there was a server error, so whatever was sent never made up to the Thorn Tree."

"So it's one of the first two."

"Right. But see that 9338 in the first one, and 1802 in the second? That's how many bytes went from the client to the server. That means the first one was a pretty long message. And the message our friend sent was… "

"… pretty damn short."

"Exactly."

"Okay," she said. "So we found the right line. I still don't get what that gives us."

"That gives us the IP number of the computer he used to send it. One-eight-seven two-oh-nine two-five-one thirty-eight."

"And every computer on the Internet has its own number?"

"Well… no." I saved the spreadsheet, just in case, expelled the floppy and handed it back to her, avoiding her eyes. "That was the way it was originally supposed to work. But it's more complicated than that. Basically as a rule of thumb any computer that's permanently on the Net has its own IP number. Unless it's behind a proxy server, or… well, there's a lot of issues. So this still might all be useless. On the other hand it might take us right to him. I can get a look at the router chain we go through to get to that machine from here, that might give us some idea where it is." I opened up a telnet session to my Unix account, typed in traceroute 187.209.251.38 and examined the lines of cryptic gibberish the computer spat out in response.

"Shee-it," I said. "That, I was not expecting."

"What?"

"That message came from Indonesia."

"Really?"

"Looks like it." I pointed at the last few lines of the traceroute response.

17 Gateway-to-hosting. indo. net. id (187.209.251.31) 641.612 ms 587.980 ms 590.526 ms

18 Quick-Serial-b. indo. net. id (187.209.251.2) 869.458 ms 669.086 ms 608.886 ms

19 187.209.251.38 (187.209.251.38) 620.897 ms 643.124 ms 588.700 ms

"See that dot-ID at the end of those last few lines? Each country has its own code. CA for Canada, UK for the United Kingdom, and so forth. ID means Indonesia."

"Indonesia is a big place," she said doubtfully.

"So it is," I said. "Let's see if we can't zoom in a little." I typed in: whois 187.209.251.38 and the computer responded

IP Address: 187.209.251.38

Server Name: WWW.JUARAPARTEMA.COM

Whois Server: whois. domaindiscover. com

"What's that? Whois?" Talena asked.

"Basically it goes out and gets the name that goes with the IP number," I said. "If any."

"Computers have names?"

"Kind of," I said. "Between each other they just use the IP number, but they figured out a long time ago that that would be hard for people to remember, so there's a system called the Domain Name Service that matches names to numbers. So you can just type in lonelyplanet-dot-com instead of sixty-four dot two-eleven and so forth."

"How does that work?" she asked. "Is there a big white pages or something?"

"Pretty much," I said. "It's a complicated descending hierarchy, but basically there's thirteen really big computers that work as the master white pages. What this just told us is that the name we're looking for is juarapertama. com, and that it was registered by a company called domaindiscover. com. Registration's turned into this big complicated mess, but basically if we go there we should be able to find out more… "

I navigated to domaindiscover. com and searched for juarapartema. com: whois: juarapartema. com

Administrative Contact, Technical Contact, Zone Contact:

Mak Hwa Sen

Internet World Cafe

Kuta Beach, Bali, DKI 33620, ID

[82] 29 9210421 root@juarapartema. com

"Gotcha," I said. "Kuta Beach, Bali. Now what the hell are you doing there?"

"Let's take a break," she said. "I'll take that drink now."

"Okay," I said. She followed me out to the kitchen. I opened the fridge and glanced in. "I've got beer and… um… water."