Hacker News Reader

Comment by packetized | Hacker News Reader

Oh, this is superfly. Easy way to build your own up-to-date ASN DB, similar to the one from Maxmind. Think: embellishing Apache/Nginx logs with up-to-date information about the IP address of the client, including ASN/OrgId. Useful for identifying snowshoers spreading their footprint across a lot of discontiguous IP addresses in one ASN/Org.

View on HN

If you just want to build your own IP-to-ASN table, you can download dumps of "RIS Raw Data" [0] from RIPE and parse them if you don't yourself run BGP.

I'm a network engineer at an ISP and it's pretty common to use something like this for analyzing traffic network when considering peering sessions, for example. Even if you don't run BGP, you could use it for answering questions like "how much traffic do we send to/receive from Facebook?" and such.

RIPE's RIS dumps are performed every five minutes from more than a dozen different "vantage points" across the Internet.

ARIN used to provide an "originAS" file [1] but it looks like they quit doing that a few years ago. You may be able to find some interesting stuff browsing around /pub on their FTP server, though [2].

[0]: https://www.ripe.net/analyse/internet-measurements/routing-i...

[1]: ftp://ftp.arin.net/pub/originAS/

[2]: ftp://ftp.arin.net/pub/

I always forget that this exists - thanks for the reminder.

Oh, if that's what you want:

https://iptoasn.com/ https://pypi.python.org/pypi/pyasn

I've been working on tweaking pyasn a bit and building a service around that.

Or if an API works for you, https://ipinfo.io

    $ curl ipinfo.io/8.8.8.8
    {
      "ip": "8.8.8.8",
      "hostname": "google-public-dns-a.google.com",
      "city": "Mountain View",
      "region": "California",
      "country": "US",
      "loc": "37.3860,-122.0840",
      "org": "AS15169 Google Inc.",
      "postal": "94035",
      "phone": "650"
    }

    $ curl ipinfo.io/8.8.8.8/org
    AS15169 Google Inc.

And ASN details are available on the web, eg https://ipinfo.io/AS15169

I'd like this service a lot more if it had a "last_refreshed" field. BGP/network-announcement hijacks aren't exactly common, but it'd be a useful bit of info to have in terms of determining how reliable the announcement is.

By "reliable" it sounds like you mean "legitimate"? As in, $asn is "authorized" to announce $prefix? "originAS" exists for that purpose.

Also, it's not clear what they're (ipinfo.io) using as their source for the ASN. Are they simply reporting the ASN as provided by ARIN, etc., or are they actually running BGP and reporting the origin ASN as they see it in announcements. My money would be on the former, in which case any prefix hijacking would not affect the data reported by ipinfo.io.

By "reliable", what I mean is that the IP address to ASN mapping is as up-to-date as possible.

I don't think a "last_refreshed" date would be that helpful, though. Netblocks aren't being shuffled around very often. I just looked at a previous employer's assignments and it was almost a decade ago that it was last updated. It's still 100% accurate, however.

Regardless, if you want it, that data is available from the RIRs. Go crazy.

That works for one lookup. The service I'm building on top of pyasn uses zeromq and can do 100,000+ lookups/sec

There's often a disconnect between something like that which works for one address, and something I could actually use to do bulk lookups on 5,000,000 addresses to generate reports.

Route server operators would prefer people didn't do something like this against their devices.

Agreed, that's why I'd run it against systems I operate that have at least one full view of the DFZ.

Is this how Maxmind gets their data?

Reply on news.ycombinator.com