News for hackers. Stuff that matters.
Re:HardCIDR will query ARIN and a pool of BGP route servers by packetized on Friday March 17, 2017 @11:38PM (#13899772)
Oh, this is superfly. Easy way to build your own up-to-date ASN DB, similar to the one from Maxmind. Think: embellishing Apache/Nginx logs with up-to-date information about the IP address of the client, including ASN/OrgId. Useful for identifying snowshoers spreading their footprint across a lot of discontiguous IP addresses in one ASN/Org.
Re:HardCIDR will query ARIN and a pool of BGP route servers by jlgaddis on Saturday March 18, 2017 @01:14AM (#13900013)
If you just want to build your own IP-to-ASN table, you can download dumps of "RIS Raw Data" [0] from RIPE and parse them if you don't yourself run BGP.

I'm a network engineer at an ISP and it's pretty common to use something like this for analyzing traffic network when considering peering sessions, for example. Even if you don't run BGP, you could use it for answering questions like "how much traffic do we send to/receive from Facebook?" and such.

RIPE's RIS dumps are performed every five minutes from more than a dozen different "vantage points" across the Internet.

ARIN used to provide an "originAS" file [1] but it looks like they quit doing that a few years ago. You may be able to find some interesting stuff browsing around /pub on their FTP server, though [2].

[0]: https://www.ripe.net/analyse/internet-measurements/routing-i...

[1]: ftp://ftp.arin.net/pub/originAS/

[2]: ftp://ftp.arin.net/pub/

Re:HardCIDR will query ARIN and a pool of BGP route servers by packetized on Saturday March 18, 2017 @03:43AM (#13900350)
I always forget that this exists - thanks for the reminder.
Re:HardCIDR will query ARIN and a pool of BGP route servers by justinsaccount on Saturday March 18, 2017 @12:08AM (#13899839)
Oh, if that's what you want:

https://iptoasn.com/ https://pypi.python.org/pypi/pyasn

I've been working on tweaking pyasn a bit and building a service around that.

Re:HardCIDR will query ARIN and a pool of BGP route servers by coderholic on Saturday March 18, 2017 @12:30AM (#13899895)
Or if an API works for you, https://ipinfo.io

    $ curl ipinfo.io/8.8.8.8
    {
      "ip": "8.8.8.8",
      "hostname": "google-public-dns-a.google.com",
      "city": "Mountain View",
      "region": "California",
      "country": "US",
      "loc": "37.3860,-122.0840",
      "org": "AS15169 Google Inc.",
      "postal": "94035",
      "phone": "650"
    }

    $ curl ipinfo.io/8.8.8.8/org
    AS15169 Google Inc.
And ASN details are available on the web, eg https://ipinfo.io/AS15169
Re:HardCIDR will query ARIN and a pool of BGP route servers by packetized on Saturday March 18, 2017 @12:57AM (#13899963)
I'd like this service a lot more if it had a "last_refreshed" field. BGP/network-announcement hijacks aren't exactly common, but it'd be a useful bit of info to have in terms of determining how reliable the announcement is.
Re:HardCIDR will query ARIN and a pool of BGP route servers by jlgaddis on Saturday March 18, 2017 @01:10AM (#13900004)
By "reliable" it sounds like you mean "legitimate"? As in, $asn is "authorized" to announce $prefix? "originAS" exists for that purpose.

Also, it's not clear what they're (ipinfo.io) using as their source for the ASN. Are they simply reporting the ASN as provided by ARIN, etc., or are they actually running BGP and reporting the origin ASN as they see it in announcements. My money would be on the former, in which case any prefix hijacking would not affect the data reported by ipinfo.io.

Re:HardCIDR will query ARIN and a pool of BGP route servers by packetized on Saturday March 18, 2017 @01:30AM (#13900045)
By "reliable", what I mean is that the IP address to ASN mapping is as up-to-date as possible.
Re:HardCIDR will query ARIN and a pool of BGP route servers by jlgaddis on Saturday March 18, 2017 @01:42AM (#13900076)
I don't think a "last_refreshed" date would be that helpful, though. Netblocks aren't being shuffled around very often. I just looked at a previous employer's assignments and it was almost a decade ago that it was last updated. It's still 100% accurate, however.

Regardless, if you want it, that data is available from the RIRs. Go crazy.

Re:HardCIDR will query ARIN and a pool of BGP route servers by justinsaccount on Saturday March 18, 2017 @09:50AM (#13901214)
That works for one lookup. The service I'm building on top of pyasn uses zeromq and can do 100,000+ lookups/sec

There's often a disconnect between something like that which works for one address, and something I could actually use to do bulk lookups on 5,000,000 addresses to generate reports.

Re:HardCIDR will query ARIN and a pool of BGP route servers by yusyusyus on Friday March 17, 2017 @11:57PM (#13899811)
Route server operators would prefer people didn't do something like this against their devices.
Re:HardCIDR will query ARIN and a pool of BGP route servers by packetized on Saturday March 18, 2017 @12:54AM (#13899952)
Agreed, that's why I'd run it against systems I operate that have at least one full view of the DFZ.
Re:HardCIDR will query ARIN and a pool of BGP route servers by lucaspiller on Saturday March 18, 2017 @12:37AM (#13899918)
Is this how Maxmind gets their data?