4 ms·

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get thos

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

strictnein 8y ago
A side note. By scanning, he probably just means a Shodan search: https://www.shodan.io/search?query=net%3A199.201.65.0%2F24&language=en https://www.shodan.io/search?query=net%3A199.201.65.0%2F24&l... Login required
sauravt 8y ago
Yes, I'd like to know this as well.
mirimir 8y ago
Using whois and BGP tools, I suspect. Edit: https://bgp.he.net/search?search%5Bsearch%5D=facebook&commit=Search https://bgp.he.net/search?search%5Bsearch%5D=facebook&commit... ... 157.240.18.0/24 ... Also see https://bgp.he.net/net/157.240.18.0/24#_whois https://bgp.he.net/net/157.240.18.0/24#_whois
deleted 8y ago
[deleted]
craigmi 8y ago
Plenty of organisations (especially one of Facebook's size) tend to have their own autonomous system numbers, pretty trivial to get the ranges from BGP announcements for any given ASN.
jelly 8y ago
Facebook, like many large internet companies, buys their IP blocks outright, so they show up under their AS number [0]. Facebook seems to have 3 AS numbers [1,2,3] and that IP appears in [3] [0] https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%29 https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%... [1] https://bgp.he.net/AS32934 https://bgp.he.net/AS32934 [2] https://bgp.he.net/AS63293 https://bgp.he.net/AS63293 [3] https://bgp.he.net/AS54115 https://bgp.he.net/AS54115
joombaga 8y ago
They're in the ARIN database. Just search for FACEBOOK-CORP https://whois.arin.net/rest/net/NET-199-201-64-0-1 https://whois.arin.net/rest/net/NET-199-201-64-0-1
lclarkmichalek 8y ago
Documented on https://developers.facebook.com/docs/sharing/webmasters/crawler/ https://developers.facebook.com/docs/sharing/webmasters/craw...
rachelbythebay 8y ago
You're going to get different results for the same queries depending on where you are in terms of DNS queries. This is not a FB thing, either. Lots of places will "steer" you towards one frontend, POP, datacenter, or whatever, in order to get you off the public Internet and onto their fabric sooner. Run the same query from a bunch of sites with different connectivity in the same town and you might get different answers depending on who's got peering agreements with who. Then spin that query again using other places in the world and you can get even more variety. That is, assuming the site in question has worked out a way to vary the A/AAAA records for their actual domain (as opposed to the hosts within it, like "www"). Some of them might just point it at a single POP/frontend/whatever, and when that one goes down for whatever reason... things get interesting. Not that I would know anything about that.

> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

strictnein 8y ago

A side note. By scanning, he probably just means a Shodan search: https://www.shodan.io/search?query=net%3A199.201.65.0%2F24&language=en https://www.shodan.io/search?query=net%3A199.201.65.0%2F24&l... Login required

sauravt 8y ago

Yes, I'd like to know this as well.

mirimir 8y ago

Using whois and BGP tools, I suspect. Edit: https://bgp.he.net/search?search%5Bsearch%5D=facebook&commit=Search https://bgp.he.net/search?search%5Bsearch%5D=facebook&commit... ... 157.240.18.0/24 ... Also see https://bgp.he.net/net/157.240.18.0/24#_whois https://bgp.he.net/net/157.240.18.0/24#_whois

deleted 8y ago

[deleted]

craigmi 8y ago

Plenty of organisations (especially one of Facebook's size) tend to have their own autonomous system numbers, pretty trivial to get the ranges from BGP announcements for any given ASN.

jelly 8y ago

Facebook, like many large internet companies, buys their IP blocks outright, so they show up under their AS number [0]. Facebook seems to have 3 AS numbers [1,2,3] and that IP appears in [3] [0] https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%29 https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%... [1] https://bgp.he.net/AS32934 https://bgp.he.net/AS32934 [2] https://bgp.he.net/AS63293 https://bgp.he.net/AS63293 [3] https://bgp.he.net/AS54115 https://bgp.he.net/AS54115

joombaga 8y ago

They're in the ARIN database. Just search for FACEBOOK-CORP https://whois.arin.net/rest/net/NET-199-201-64-0-1 https://whois.arin.net/rest/net/NET-199-201-64-0-1

lclarkmichalek 8y ago

Documented on https://developers.facebook.com/docs/sharing/webmasters/crawler/ https://developers.facebook.com/docs/sharing/webmasters/craw...

rachelbythebay 8y ago

You're going to get different results for the same queries depending on where you are in terms of DNS queries. This is not a FB thing, either. Lots of places will "steer" you towards one frontend, POP, datacenter, or whatever, in order to get you off the public Internet and onto their fabric sooner. Run the same query from a bunch of sites with different connectivity in the same town and you might get different answers depending on who's got peering agreements with who. Then spin that query again using other places in the world and you can get even more variety. That is, assuming the site in question has worked out a way to vary the A/AAAA records for their actual domain (as opposed to the hosts within it, like "www"). Some of them might just point it at a single POP/frontend/whatever, and when that one goes down for whatever reason... things get interesting. Not that I would know anything about that.