Introduction
A couple services have been established for mapping IP numbers to BGP prefixes and ASNs:
- Whois (TCP 43)
- DNS (UDP 53)
Three modes are supported origin, peer, and prefix. The data returned is basically the same except that the peer mode also lists the BGP peers for the ASN.
The data to support these services are collected from the following sources:
Whois
The whois interface is used as follows:
Whois/Origin
$ whois -h asn.shadowserver.org origin 17.112.152.32
714 | 17.112.0.0/16 | APPLE-ENGINEERING | US | APPLE.COM | APPLE COMPUTER INC
The output is as follows
ASN | Prefix | AS Name | CN | Domain | ISP
Whois/Peer
Using the peer mode is very similar:
$ whois -h asn.shadowserver.org peer 17.112.152.32
3356 7018 | 714 | 17.112.0.0/16 | APPLE-ENGINEERING | US | APPLE.COM | APPLE COMPUTER INC
The output is as follows
Peer(s) | ASN | Prefix | AS Name | CN | Domain | ISP
A more verbose mode is also available:
$ whois -h asn.shadowserver.org peer 4.5.6.4 verbose
3356 | 4.0.0.0/9 | LEVEL3 | US | DSL-VERIZON.NET | GTE.NET LLC
209 ASN-QWEST Qwest
293 ESNET Energy Sciences Network
701 UUNET MCI Communications Services, Inc. d/b/a Verizon Business
702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe
1239 SPRINTLINK Sprint
1668 AOL-ATDN AOL Transit Data Network
2497 JPNIC-ASBLOCK AP JPNIC
2828 XO-AS15 XO Communications
2914 NTT-COMMUNICATIONS-2 NTT America, Inc.
3257 TISCALI BACKBONE Tiscali Intl Network BV
3303 SWISSCOM Swisscom Solutions Ltd
3333 RIPE-NCC AS RIPE Network Coordination Centre
3356 LEVEL3 Level 3 Communications
3549 GBLX Global Crossing Ltd.
3561 SAVVIS Savvis
4513 Globix Corporation
4637 REACH Reach Network Border AS
5459 LINX AS London Internet Exchange Ltd.
5511 OPENTRANSIT France Telecom
6079 RCN-AS RCN Corporation
6395 BROADWING Broadwing Communications Services, Inc.
6453 GLOBEINTERNET VSNL International
6461 MFNX MFN - Metromedia Fiber Network
7018 ATT-INTERNET4 AT&T WorldNet Services
8075 MICROSOFT-CORP---MSN Microsoft Corp
12956 TELEFONICA Telefonica Backbone Autonomous System
Whois/Prefix
$ whois -h asn.shadowserver.org prefix 8075
64.4.0.0/18
65.54.8.0/22
65.54.48.0/20
65.54.74.0/23
65.54.80.0/23
65.54.83.0/24
65.54.86.0/23
65.54.92.0/23
65.54.94.0/23
65.54.96.0/20
65.54.120.0/21
65.54.128.0/19
<<CHOPPED>>
Whois Batch Mode
The Whois server also supports batch mode where a list of IP addresses can be handled. For example:
begin origin
4.5.4.3
17.112.152.32
208.77.188.166
end
Use netcat, telnet, or perl to send your list to the whois server:
$ netcat asn.shadowserver.org 43 < /tmp/list
3356 | 4.0.0.0/9 | LEVEL3 | US | DSL-VERIZON.NET | GTE.NET LLC
714 | 17.112.0.0/16 | APPLE-ENGINEERING | US | APPLE.COM | APPLE COMPUTER INC
40528 | 208.77.188.0/22 | ICANN-LAX | - | - | -
DNS
The format for a DNS based origin lookup is:
$ dig +short 32.152.112.17.origin.asn.shadowserver.org TXT
"714" "|" "17.112.0.0/16" "|" "APPLE-ENGINEERING" "|" "US" "|" "APPLE.COM" "|" "APPLE" "COMPUTER" "INC"
And the format for a ”peer’ lookup is:
$ dig +short 32.152.112.17.peer.asn.shadowserver.org TXT
"3356" "7018" "|" "714" "|" "17.112.0.0/16" "|" "APPLE-ENGINEERING" "|" "US" "|" "APPLE.COM" "|" "APPLE" "COMPUTER" "INC"
