标签： 监测.WHOIS

IP-BGP 以及 BGP Monitoring / BGP 监测

IP-BGP

Introduction

A couple services have been established for mapping IP numbers to BGP prefixes and ASNs:

  • Whois (TCP 43)
  • DNS (UDP 53)

Three modes are supported origin, peer, and prefix.  The data returned is basically the same except that the peer mode also lists the BGP peers for the ASN.

The data to support these services are collected from the following sources:

Whois

The whois interface is used as follows:

Whois/Origin

 
$ whois -h asn.shadowserver.org origin 17.112.152.32
714 | 17.112.0.0/16 | APPLE-ENGINEERING | US | APPLE.COM | APPLE COMPUTER INC

The output is as follows

ASN | Prefix        | AS Name           | CN | Domain    | ISP

Whois/Peer

Using the peer mode is very similar:

$ whois -h asn.shadowserver.org peer 17.112.152.32
3356 7018 | 714 | 17.112.0.0/16 | APPLE-ENGINEERING | US | APPLE.COM | APPLE COMPUTER INC

The output is as follows

Peer(s)   | ASN | Prefix        | AS Name           | CN | Domain    | ISP

A more verbose mode is also available:

$ whois -h asn.shadowserver.org peer 4.5.6.4 verbose
 3356 | 4.0.0.0/9 | LEVEL3 | US | DSL-VERIZON.NET | GTE.NET LLC

  209    ASN-QWEST             Qwest
  293    ESNET                 Energy Sciences Network
  701    UUNET                 MCI Communications Services, Inc. d/b/a Verizon Business
  702    AS702                 Verizon Business EMEA - Commercial IP service provider in Europe
  1239   SPRINTLINK            Sprint
  1668   AOL-ATDN              AOL Transit Data Network
  2497   JPNIC-ASBLOCK         AP JPNIC
  2828   XO-AS15               XO Communications
  2914   NTT-COMMUNICATIONS-2  NTT America, Inc.
  3257   TISCALI               BACKBONE Tiscali Intl Network BV
  3303   SWISSCOM              Swisscom Solutions Ltd
  3333   RIPE-NCC              AS RIPE Network Coordination Centre
  3356   LEVEL3                Level 3 Communications
  3549   GBLX                  Global Crossing Ltd.
  3561   SAVVIS                Savvis
  4513   Globix                Corporation
  4637   REACH                 Reach Network Border AS
  5459   LINX                  AS London Internet Exchange Ltd.
  5511   OPENTRANSIT           France Telecom
  6079   RCN-AS                RCN Corporation
  6395   BROADWING             Broadwing Communications Services, Inc.
  6453   GLOBEINTERNET         VSNL International
  6461   MFNX                  MFN - Metromedia Fiber Network
  7018   ATT-INTERNET4         AT&T WorldNet Services
  8075   MICROSOFT-CORP---MSN  Microsoft Corp
  12956  TELEFONICA            Telefonica Backbone Autonomous System

Whois/Prefix

 
$ whois -h asn.shadowserver.org prefix 8075
64.4.0.0/18                                                           
65.54.8.0/22                                                          
65.54.48.0/20                                                         
65.54.74.0/23                                                         
65.54.80.0/23                                                         
65.54.83.0/24                                                         
65.54.86.0/23                                                         
65.54.92.0/23                                                         
65.54.94.0/23                                                         
65.54.96.0/20                                                         
65.54.120.0/21                                                        
65.54.128.0/19        
<<CHOPPED>>

Whois Batch Mode

The Whois server also supports batch mode where a list of IP addresses can be handled.  For example:

begin origin
4.5.4.3
17.112.152.32
208.77.188.166
end

Use netcat, telnet, or perl to send your list to the whois server:

$ netcat asn.shadowserver.org 43 < /tmp/list
3356 | 4.0.0.0/9 | LEVEL3 | US | DSL-VERIZON.NET | GTE.NET LLC
714 | 17.112.0.0/16 | APPLE-ENGINEERING | US | APPLE.COM | APPLE COMPUTER INC
40528 | 208.77.188.0/22 | ICANN-LAX | - | - | -

DNS

The format for a DNS based origin lookup is:

$ dig +short 32.152.112.17.origin.asn.shadowserver.org TXT
"714" "|" "17.112.0.0/16" "|" "APPLE-ENGINEERING" "|" "US" "|" "APPLE.COM" "|" "APPLE" "COMPUTER" "INC"

And the format for a ”peer’ lookup is:

$ dig +short 32.152.112.17.peer.asn.shadowserver.org TXT
"3356" "7018" "|" "714" "|" "17.112.0.0/16" "|" "APPLE-ENGINEERING" "|" "US" "|" "APPLE.COM" "|" "APPLE" "COMPUTER" "INC"

http://www.shadowserver.org/wiki/pmwiki.php/Services/IP-BGP

Shadowserver

Other Res :  BGP Monitoring   http://www.team-cymru.org/Monitoring/BGP/

Team Cymru