4 ms·

Oh, this is superfly. Easy way to build your own up-to-date ASN DB, similar to the one from Maxmind. Think: embellishing Apache/Nginx logs with up-to-date infor

Oh, this is superfly. Easy way to build your own up-to-date ASN DB, similar to the one from Maxmind. Think: embellishing Apache/Nginx logs with up-to-date information about the IP address of the client, including ASN/OrgId. Useful for identifying snowshoers spreading their footprint across a lot of discontiguous IP addresses in one ASN/Org.

yusyusyus 10y ago
Route server operators would prefer people didn't do something like this against their devices.
- packetized 10y ago
  Agreed, that's why I'd run it against systems I operate that have at least one full view of the DFZ.
justinsaccount 10y ago
Oh, if that's what you want: https://iptoasn.com/ https://iptoasn.com/ https://pypi.python.org/pypi/pyasn https://pypi.python.org/pypi/pyasn I've been working on tweaking pyasn a bit and building a service around that.
- coderholic 10y ago
  Or if an API works for you, https://ipinfo.io https://ipinfo.io $ curl ipinfo.io/8.8.8.8 { "ip": "8.8.8.8", "hostname": "google-public-dns-a.google.com", "city": "Mountain View", "region": "California", "country": "US", "loc": "37.3860,-122.0840", "org": "AS15169 Google Inc.", "postal": "94035", "phone": "650" } $ curl ipinfo.io/8.8.8.8/org AS15169 Google Inc. And ASN details are available on the web, eg https://ipinfo.io/AS15169 https://ipinfo.io/AS15169
  - packetized 10y ago
    I'd like this service a lot more if it had a "last_refreshed" field. BGP/network-announcement hijacks aren't exactly common, but it'd be a useful bit of info to have in terms of determining how reliable the announcement is.
    - jlgaddis 10y ago
      By "reliable" it sounds like you mean "legitimate"? As in, $asn is "authorized" to announce $prefix? "originAS" exists for that purpose. Also, it's not clear what they're (ipinfo.io) using as their source for the ASN. Are they simply reporting the ASN as provided by ARIN, etc., or are they actually running BGP and reporting the origin ASN as they see it in announcements. My money would be on the former, in which case any prefix hijacking would not affect the data reported by ipinfo.io.
      - packetized 10y ago
        By "reliable", what I mean is that the IP address to ASN mapping is as up-to-date as possible.
        jlgaddis 10y ago
        I don't think a "last_refreshed" date would be that helpful, though. Netblocks aren't being shuffled around very often. I just looked at a previous employer's assignments and it was almost a decade ago that it was last updated. It's still 100% accurate, however. Regardless, if you want it, that data is available from the RIRs. Go crazy.
  - deleted 10y ago
    [deleted]
  - justinsaccount 10y ago
    That works for one lookup. The service I'm building on top of pyasn uses zeromq and can do 100,000+ lookups/sec There's often a disconnect between something like that which works for one address, and something I could actually use to do bulk lookups on 5,000,000 addresses to generate reports.
lucaspiller 10y ago
Is this how Maxmind gets their data?
jlgaddis 10y ago
If you just want to build your own IP-to-ASN table, you can download dumps of "RIS Raw Data" [0] from RIPE and parse them if you don't yourself run BGP. I'm a network engineer at an ISP and it's pretty common to use something like this for analyzing traffic network when considering peering sessions, for example. Even if you don't run BGP, you could use it for answering questions like "how much traffic do we send to/receive from Facebook?" and such. RIPE's RIS dumps are performed every five minutes from more than a dozen different "vantage points" across the Internet. ARIN used to provide an "originAS" file [1] but it looks like they quit doing that a few years ago. You may be able to find some interesting stuff browsing around /pub on their FTP server, though [2]. [0]: https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ris-raw-data https://www.ripe.net/analyse/internet-measurements/routing-i... [1]: ftp://ftp.arin.net/pub/originAS/ [2]: ftp://ftp.arin.net/pub/
- packetized 10y ago
  I always forget that this exists - thanks for the reminder.

yusyusyus 10y ago

Route server operators would prefer people didn't do something like this against their devices.

packetized 10y ago
Agreed, that's why I'd run it against systems I operate that have at least one full view of the DFZ.

justinsaccount 10y ago

Oh, if that's what you want: https://iptoasn.com/ https://iptoasn.com/ https://pypi.python.org/pypi/pyasn https://pypi.python.org/pypi/pyasn I've been working on tweaking pyasn a bit and building a service around that.

coderholic 10y ago
Or if an API works for you, https://ipinfo.io https://ipinfo.io $ curl ipinfo.io/8.8.8.8 { "ip": "8.8.8.8", "hostname": "google-public-dns-a.google.com", "city": "Mountain View", "region": "California", "country": "US", "loc": "37.3860,-122.0840", "org": "AS15169 Google Inc.", "postal": "94035", "phone": "650" } $ curl ipinfo.io/8.8.8.8/org AS15169 Google Inc. And ASN details are available on the web, eg https://ipinfo.io/AS15169 https://ipinfo.io/AS15169
- packetized 10y ago
  I'd like this service a lot more if it had a "last_refreshed" field. BGP/network-announcement hijacks aren't exactly common, but it'd be a useful bit of info to have in terms of determining how reliable the announcement is.
  - jlgaddis 10y ago
    By "reliable" it sounds like you mean "legitimate"? As in, $asn is "authorized" to announce $prefix? "originAS" exists for that purpose. Also, it's not clear what they're (ipinfo.io) using as their source for the ASN. Are they simply reporting the ASN as provided by ARIN, etc., or are they actually running BGP and reporting the origin ASN as they see it in announcements. My money would be on the former, in which case any prefix hijacking would not affect the data reported by ipinfo.io.
    - packetized 10y ago
      By "reliable", what I mean is that the IP address to ASN mapping is as up-to-date as possible.
      - jlgaddis 10y ago
        I don't think a "last_refreshed" date would be that helpful, though. Netblocks aren't being shuffled around very often. I just looked at a previous employer's assignments and it was almost a decade ago that it was last updated. It's still 100% accurate, however. Regardless, if you want it, that data is available from the RIRs. Go crazy.
- deleted 10y ago
  [deleted]
- justinsaccount 10y ago
  That works for one lookup. The service I'm building on top of pyasn uses zeromq and can do 100,000+ lookups/sec There's often a disconnect between something like that which works for one address, and something I could actually use to do bulk lookups on 5,000,000 addresses to generate reports.

lucaspiller 10y ago

Is this how Maxmind gets their data?

jlgaddis 10y ago

If you just want to build your own IP-to-ASN table, you can download dumps of "RIS Raw Data" [0] from RIPE and parse them if you don't yourself run BGP. I'm a network engineer at an ISP and it's pretty common to use something like this for analyzing traffic network when considering peering sessions, for example. Even if you don't run BGP, you could use it for answering questions like "how much traffic do we send to/receive from Facebook?" and such. RIPE's RIS dumps are performed every five minutes from more than a dozen different "vantage points" across the Internet. ARIN used to provide an "originAS" file [1] but it looks like they quit doing that a few years ago. You may be able to find some interesting stuff browsing around /pub on their FTP server, though [2]. [0]: https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ris-raw-data https://www.ripe.net/analyse/internet-measurements/routing-i... [1]: ftp://ftp.arin.net/pub/originAS/ [2]: ftp://ftp.arin.net/pub/

packetized 10y ago
I always forget that this exists - thanks for the reminder.