wikiroute

networking recipes

User Tools

Site Tools


who_is_using_this_ip_address

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Next revisionBoth sides next revision
who_is_using_this_ip_address [2014/02/09 13:23] – [Basic Steps] samerwho_is_using_this_ip_address [2014/02/09 14:21] – [2.2- Riswhois Server] samer
Line 1: Line 1:
 ====== Who is Using This IP Address? ===== ====== Who is Using This IP Address? =====
  
-A frequent question that faces network administrators or application developers consists in identifying //who is using a specific public IP address//. This information can be utilized for instance to perform user localization and enable location-based services or user access control. In this context, a main technical challenge is to associate the IP address or prefix with its corresponding Autonomous System (AS).+A frequent question that faces network administrators or application developers consists in identifying //who is using a specific public IP address//. This information can be utilized for instance to perform user localization and enable location-based services or user access control. In this context, a main technical challenge is to associate an IP address or prefix with its corresponding Autonomous System (AS).
  
 ===== -- Limitations of the whois Information ===== ===== -- Limitations of the whois Information =====
Line 45: Line 45:
        Community: 15290:3356 15290:64995 15290:65050 15290:65506        Community: 15290:3356 15290:64995 15290:65050 15290:65506
  
-Despite its availability, this method remains cumbersome, especially if you want to quickly look up something or if you have a large number of prefixes that you want to analyse with a script. Fortunately, RIPE NCC and Team Cymru have already answered these questions: they provide solutions that combine the versatility of the whois protocol with the accuracy of the BGP information. In other words, you keep on using the legacy whois command but you get BGP-based results. +Despite its availability, this method remains cumbersome, especially if you want to quickly look up something or if you have a large number of prefixes that you want to analyse with a script. Fortunately, RIPE NCC and Team Cymru have already answered these requirements: they provide solutions that combine the versatility of the whois protocol with the accuracy of the BGP information. In other words, you keep on using the legacy whois command but you get BGP-based results. 
  
 ==== -- Team Cymru whois Server ==== ==== -- Team Cymru whois Server ====
Line 68: Line 68:
  
 ==== -- Riswhois Server ==== ==== -- Riswhois Server ====
-RIPE NCC implements a similar whois service named RISwhois by providing a higher level view over the most recently collected set of routing tables from the Remote Route Collectors (RRCs) at different [[http://www.ripe.net/data-tools/stats/ris/ris-peering-policy | locations]] in the world. Given an IPv4 or IPv6 prefix, RISwhois will tell which prefixes and origin ASes on which RRCs match that particular IP.+RIPE NCC implements a similar whois service named RISwhois. This service provides a higher level view over the most recently collected set of routing tables from the Remote Route Collectors (RRCs) at different [[http://www.ripe.net/data-tools/stats/ris/ris-peering-policy | locations]] in the world. Given an IPv4 or IPv6 prefix, RISwhois will tell which prefixes and origin ASes on which RRCs match that particular IP.
  
 <WRAP info> <WRAP info>
Line 74: Line 74:
 </WRAP> </WRAP>
  
-In the following, a simple example shows the output of a Riswhois query: ''203.178.141.194'' is originated by AS ''2500'' as seen by 16 RRCs.+In the following, a simple example shows the output of a Riswhois query: as seen by 16 RRCs, the IP address ''203.178.141.194'' is originated by AS ''2500''.
  
 <code> <code>
Line 144: Line 144:
   - [[http://cpansearch.perl.org/src/TPODER/Net-NfDump-0.12/examples/download_asn_db | Net-NfDump]]: a perl library that makes use of the [[http://search.cpan.org/~tpoder/Net-IP-LPM-0.02/ | Net::IP::LPM]] implementation of Longest Prefix Match algorithm.    - [[http://cpansearch.perl.org/src/TPODER/Net-NfDump-0.12/examples/download_asn_db | Net-NfDump]]: a perl library that makes use of the [[http://search.cpan.org/~tpoder/Net-IP-LPM-0.02/ | Net::IP::LPM]] implementation of Longest Prefix Match algorithm. 
   - [[https://github.com/CIRCL/IP-ASN-history | IP-ASN-history]]: a client/server (with a client web interface) software to store efficiently the history of BGP announces and quickly lookup IP addresses origins.   - [[https://github.com/CIRCL/IP-ASN-history | IP-ASN-history]]: a client/server (with a client web interface) software to store efficiently the history of BGP announces and quickly lookup IP addresses origins.
 +  - [[http://pwhois.org/server.who | pwhois]]: a client/server software that makes use of a PostgreSQL database to store routing information. FIXME Did not succeed to install it on Mac OS X 10.9.1.  
who_is_using_this_ip_address.txt · Last modified: 2014/02/15 23:31 by samer