who_is_using_this_ip_address
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
who_is_using_this_ip_address [2014/02/08 22:06] – samer | who_is_using_this_ip_address [2014/02/09 12:47] – [2- Using BGP Information] samer | ||
---|---|---|---|
Line 10: | Line 10: | ||
origin: | origin: | ||
- | However things get complicated very rapidly since the route object information is not always provided or may be outdated. Trying for example to identify the AS announcing 203.178.141.194 (corresponding to the famous www.kame.net), | + | However things get complicated very rapidly since the route object information is not always provided or may be outdated. Trying for example to identify the AS announcing |
$ whois -h whois.apnic.net 203.178.141.194 | grep origin | $ whois -h whois.apnic.net 203.178.141.194 | grep origin | ||
Line 21: | Line 21: | ||
However, having access to a DFZ BGP router is not easy in practice. Alternatively, | However, having access to a DFZ BGP router is not easy in practice. Alternatively, | ||
- | Let us try for example to log on the Allstream route server in Canada and identify the origin AS of 148.60.0.0/ | + | Let us try for example to log on the Allstream route server in Canada and identify the origin AS of '' |
$ telnet route-server.east.bb.allstream.net | $ telnet route-server.east.bb.allstream.net | ||
Line 45: | Line 45: | ||
Community: 15290:3356 15290:64995 15290:65050 15290:65506 | Community: 15290:3356 15290:64995 15290:65050 15290:65506 | ||
- | Despite its availability, | + | Despite its availability, |
- | | + | ==== -- Team Cymru whois Server ==== |
- | - A similar service was announced by the RIPE RIS project. Their whois server can be queried using '' | + | Team Cymru implements |
- | $ whois -h riswhois.ripe.net 217.70.180.132 | + | < |
- | % This is RIPE NCC's Routing Information Service | + | $ whois -h whois.cymru.com 148.60.0.0/16 |
- | % whois gateway to collected BGP Routing Tables | + | AS | IP | AS Name |
- | % IPv4 or IPv6 address to origin prefix match | + | 2200 | 148.60.0.0 | FR-RENATER Reseau National de telecommunications pour la Technologie |
- | % | + | </code> |
- | % For more information visit http://www.ripe.net/ | + | |
- | + | ||
- | route: | + | |
- | origin: | + | |
- | descr: | + | |
- | lastupd-frst: | + | |
- | lastupd-last: | + | |
- | seen-at: | + | |
- | num-rispeers: | + | |
- | source: | + | |
- | + | ||
- | route: | + | |
- | origin: | + | |
- | descr: | + | |
- | lastupd-frst: 2013-09-24 09: | + | |
- | lastupd-last: | + | |
- | seen-at: | + | |
- | num-rispeers: | + | |
- | source: | + | |
- | + | ||
- | route: | + | |
- | origin: | + | |
- | descr: | + | |
- | lastupd-frst: | + | |
- | lastupd-last: | + | |
- | seen-at: | + | |
- | num-rispeers: | + | |
- | source: | + | |
+ | and another example that demonstrates the possibility of sending multiple prefixes in the same query: | ||
+ | < | ||
+ | $ whois -h whois.cymru.com 148.60.0.0/ | ||
+ | AS | IP | AS Name | ||
+ | 2200 | 148.60.0.0 | ||
+ | AS | IP | AS Name | ||
+ | 2500 | 203.178.141.194 | ||
+ | </ | ||
+ | |||
+ | ==== -- Riswhois Server ==== | ||
+ | RIPE NCC implements a similar whois service named RISwhois by providing a higher level view over the most recently collected set of routing tables from the Remote Route Collectors (RRCs) at different [[http:// | ||
+ | |||
+ | <WRAP info> | ||
+ | As mentioned on the [[http:// | ||
+ | </ | ||
+ | |||
+ | In the following, a simple example shows the output of a Riswhois query: '' | ||
+ | |||
+ | < | ||
+ | $ whois -h riswhois.ripe.net 203.178.141.194 | ||
+ | route: | ||
+ | origin: | ||
+ | descr: | ||
+ | lastupd-frst: | ||
+ | lastupd-last: | ||
+ | seen-at: | ||
+ | num-rispeers: | ||
+ | source: | ||
+ | </ | ||
+ | |||
+ | <WRAP round important> | ||
+ | Due to BGP policies between ASes in the Internet, RRCs may receive different BGP information for the same IP prefix. Therefore, Riswhois provides multiple matchings for the IP prefix, as in the following example. In such cases, a longest prefix matching may help in choosing a single originating AS. | ||
+ | </ | ||
+ | |||
+ | < | ||
+ | $ whois -h riswhois.ripe.net 217.70.184.1 | ||
+ | route: | ||
+ | origin: | ||
+ | descr: | ||
+ | lastupd-frst: | ||
+ | lastupd-last: | ||
+ | seen-at: | ||
+ | num-rispeers: | ||
+ | source: | ||
+ | |||
+ | route: | ||
+ | origin: | ||
+ | descr: | ||
+ | lastupd-frst: | ||
+ | lastupd-last: | ||
+ | seen-at: | ||
+ | num-rispeers: | ||
+ | source: | ||
+ | </ | ||
===== -- A Do-It-Yourself BGP Query Service ===== | ===== -- A Do-It-Yourself BGP Query Service ===== | ||
Start by downloading multiple routing tables for routeviews or RIPE RIS servers. Transform these tables into parsable format bu using bgpdump. Use any scripting language to perform a best prefix match and output the origin AS of your desired IP prefix. | Start by downloading multiple routing tables for routeviews or RIPE RIS servers. Transform these tables into parsable format bu using bgpdump. Use any scripting language to perform a best prefix match and output the origin AS of your desired IP prefix. |
who_is_using_this_ip_address.txt · Last modified: 2014/02/15 23:31 by samer