Is there a tool or method to determine IP blocks assigned to an organization by ASN? I.e. if I have an organization's ASN number I want to know all blocks assigned to that ASN.
Thank you.
Andrew Iwamoto
Unleashed Technologies
you mean like radb?
or follow the example for ip -> asn from joe:
http://pages.uoregon.edu/joe/one-pager-asn.pdf
what's the end goal you have? "make bgp filters" something else?
-chris
Hi Andrew.
Check this script I made sometime ago, it gets the information you
want, I was using it to reroute all the networks of specifics AS
trough a VPN :
https://github.com/mathieupoussin/junos_reroute_asn/blob/master/reroute_asn.pl
To make it simpler, use the command "whois -h whois.radb.net -i origin
12345", make sure you use the RIPE whois client.
Best regards,
Mathieu
I'm partial to IRR inverse queries on origin:
'whois -h whois.radb.net -- "-i origin AS<ASN goes here>" | grep route'
That's RIR/NIR-dependent, so you probably have to go thru all of them to
map all possible IP blocks. Other references suggested bgp.he.net that will
only list advertised networks, and IRRs will only have IRR-listed networks.
For instance, on ARIN for AS 15141:
http://whois.arin.net/rest/asn/AS15141
Find the organization name; click on the link
http://whois.arin.net/rest/org/BAUSCH-1.html
Find the networks link:
http://whois.arin.net/rest/org/BAUSCH-1/nets
Network ResourcesBAUSCH-LOMB (NET-161-242-0-0-1
<http://whois.arin.net/rest/net/NET-161-242-0-0-1.html>)161.242.0.0 -
161.242.255.255
Look for the other RIRs; rinse and repeat.
Rubens
Step 1: Input an IP prefix for the originating ASN of a prefix
https://radar.qrator.net
Step2: Check the RIR whois (as stated below) for confirmation as to who's
assigned space.
Thank You
Bob Evans
CTO
ip address blocks are not assigned to ASNs. IP address blocks and ASNs are
assigned to organisations or people.
If IP address blocks are used on the public internet, there is no guarantee
that the ASN used to announce them is assigned to the same organisation
that was assigned those blocks.
Several people have made suggestions to use various lookup tools:
- IRR databases will often return garbage, and it is unwise to depend on
their output being accurate.
- live lookups up ASN announcements on the public internet will only tell
you who is currently announcing a particular prefix on a particular asn.
This will not give any information
- some RIR databases provide accurate allocation trails. Probably the RIPE
NCC is most accurate / easy to use in this regard because of the way their
data is presented in their database. This will only apply to allocations
they've made, though.
Anyway, it's not fully clear what you're asking. If you need a more
specific answer, you will need to ask a more specific question.
Nick
Is there a tool or method to determine IP blocks assigned to an
organization by ASN? I.e. if I have an organization's ASN number I want to
know all blocks assigned to that ASN.
If you want to know the registry assignments / allocations made to a single entity and be able group together these assignments of address prefixes and ASNs you should retrieve the combined extended stats file from the RIRs (https://www.nro.net/wp-content/uploads/apnic-uploads/delegated-extended) and group together all those entries with a common value in column 8 (except for the entries corresponding to assignments and allocations made by the RIPE NCC, where this information is, unfortunately, not published by them in such a convenient format.)
Geoff
If you want to know the registry assignments / allocations made to a
single entity and be able group together these assignments of address
prefixes and ASNs you should retrieve the combined extended stats file
from the RIRs
(https://www.nro.net/wp-content/uploads/apnic-uploads/delegated-extended)
and group together all those entries with a common value in column 8
(except for the entries corresponding to assignments and allocations
made by the RIPE NCC, where this information is, unfortunately, not
published by them in such a convenient format.)
care to give a decode for the fields in that file? 
randy
sure, I'll try.
for example:
arin>US>asn>32|1|19840924|assigned|658cc9c515b51665f88b7fd1bc213d20|e-stats
Col 1 - RIR name, or 'iana'
Col 2 - The country where the entity 'resides' (or 'EU' in some cases), or 'ZZ' for reserved and unassigned blocks
Col 3 - 'asn' or 'ipv4' or 'ipv6'
Col 4 - The size of the allocation (asn or IPv4) or the prefix length (ipv6)
Col 5 - The starting value of the block
Col 6 - A date. For some registries this is the date of the original allocation - for others (ARIN) its not so clear precisely what this date signifies (!)
Col 7 - Status of the block
Col 8 - A hash field of the entity code (mu;ltiple allocations to the same entity have the same code) or null (RIPE NCC, IANA)
Col 9 - The source of the record (either "e-stats' where the original source is an extended stats file published by an RIR, or 'iana' if the data is lifted from an IANA registry)
it looks like Col-8 is normalized on 'OrgId' right?
So if the company has many org-ids you'd have to track all of those
down to get a clear(er) picture.
So if the company has many org-ids you'd have to track all of those
down to get a clear(er) picture.
and good luck with that in the arin region
>
>> If you want to know the registry assignments / allocations made to a
>> single entity and be able group together these assignments of address
>> prefixes and ASNs you should retrieve the combined extended stats file
>> from the RIRs
>> (https://www.nro.net/wp-content/uploads/apnic-uploads/delegated-extended)
>> and group together all those entries with a common value in column 8
>> (except for the entries corresponding to assignments and allocations
>> made by the RIPE NCC, where this information is, unfortunately, not
>> published by them in such a convenient format.)
>
> care to give a decode for the fields in that file?sure, I'll try.
Or:
https://www.nro.net/wp-content/uploads/nro-extended-stats-readme5.txt
-Hank
Users of this report should be aware that there are some subtle deviations from this spec in the published data:
- the RIPE NCC uses the non-ISO 3166 2 letter code 'EU' for some allocations. I do not know exactly why;
- the date field is not quite as described in that file for ARIN entries. Again, I do not know why.
- the RIPE NCC does not provide the "opaque-id" in their records
I believe ERX records transferred from ARIN to RIPE will have EU listed as country code until RIPE is contacted to correct it.
-Hank
Some of the EU allocations seem to be CDNs and other trans-national operators.
Regards...jmcc
Users of this report should be aware that there are some subtle deviations from this spec in the published data:
- the RIPE NCC uses the non-ISO 3166 2 letter code 'EU' for some allocations. I do not know exactly why;
EU is, of course, an ISO-3166 2 letter code, it just happens to be "Exceptionally Reserved". I would naively have assumed EU was used for entities that span multiple European countries.
- the date field is not quite as described in that file for ARIN entries. Again, I do not know why.
- the RIPE NCC does not provide the "opaque-id" in their records
Regards,
-drc
Hi Andrew,
RIPEstat makes this easy for resources that belong to the RIPE NCC region:
1. Go to stat.ripe.net
https://stat.ripe.net
2. Look up the ASN (for example, AS3333)
https://stat.ripe.net/as3333
3. On the "Database" tab, navigate to the Registry Browser widget and
click on the organisation object located in the right-hand list
4. The left-hand table lists all aut-num, inetnum and inet6num objects
registered under this organisation object.
https://stat.ripe.net/as3333#tabId=database&database_registry-browser.resource=organisation:ORG-RIEN1-RIPE
Plans are to extend the Registry Browser to other RIR's databases as
well. In the meanwhile the Routing Consistency can be of help for
resources outside our region.
https://stat.ripe.net/widget/as-routing-consistency#w.resource=AS3333
This widget lists and crosschecks routes found in BGP routing data
(based on RIS [0]) as well as the RIPE NCC's and RADb's [1] Internet
Routing Registries.
The "Database" tab might contain other widgets that you find useful in
case you are looking for Registry-related information. If you are
interested in BGP routing-related data, the "Routing" tab is for you;
specifically I'd like to point out the Announced Prefixes and Routing
History widget.
In case you have any questions on the presented information, please
refer to the widget's "Info" button and/or RIPEstat's documentation [2].
Cheers,
Christian
[0] The Routing Information System (RIS), http://ris.ripe.net
[1] http://www.radb.net/
[2] https://stat.ripe.net/docs/widget_api
https://stat.ripe.net/docs/data_api