Looking for up to date CIDR to ASN mapping

black

I'm looking for a CIDR to ASN list that updates as often as possible. It should look something like

8.8.8.0/24 15169

I found http://thyme.apnic.net/current/ but it doesn't seem to be up to date and I didn't come across any other good ones. I'm not looking for a IP to ASN querying service, I'm looking for the entire prefix to ASN table. I'm pretty sure I can get it if I run my own BGP session but that's going a bit too far.

rds100

Probably running your own bgpd and getting a full BGP feed would be the best way to do it if you need the information to be updated frequently. If you query someone else's router for the full BGP table often it will cause unnecessary CPU load to their router.

gbshouse

http://www.team-cymru.org/IP-ASN-mapping.html

Edit: you can also use http://routeviews.org/ to parse most recent route tables

black

I'm only looking to pull data once or twice every day, which might still be too much. Thanks for the suggestion, I'll look into it.

rds100

If it's only once or twice per day and not once a minute you could telnet route-views.oregon-ix.net and pull their routing table and parse it. Can be automated with expect.

MarkTurner

rds100 said: If it's only once or twice per day and not once a minute you could telnet route-views.oregon-ix.net and pull their routing table and parse it. Can be automated with expect.

They'll probably get quite pissy about that. They don't mind specified prefix lookups but full routing tables they quickly start blocking IPs.

@Black - best option BGP feed, run exabgp and dump it to a database. I am doing exactly that.

rds100

MarkTurner said: They'll probably get quite pissy about that. They don't mind specified prefix lookups but full routing tables they quickly start blocking IPs.

Their route server was very slow and overloaded years ago when it was running on some old cisco. Now it's running on quagga / bgpd and is quite fast. I don't know if they do block IPs, haven't done anything to justify blocking me yet

MarkTurner

rds100 said: I don't know if they do block IPs, haven't done anything to justify blocking me yet

I know someone who got blocked and a stern email to say stop running expensive queries

black

BGP feeds seem tough to get my hands on. Are there any public sources? I'll go ahead and shoot routeviews.org an email and see if they're ok with me running show ip bgp and getting the full output.

gbshouse

Routeviews already provide dumps which are easy to parse http://routeviews.org/route-views4/bgpdata/

MarkTurner

black said: BGP feeds seem tough to get my hands on.

This is relatively easy to get setup. PM me and I'll explain options

black

gbshouse said: Routeviews already provide dumps which are easy to parse http://routeviews.org/route-views4/bgpdata/

Thanks.

MarkTurner said: This is relatively easy to get setup. PM me and I'll explain options

Thanks for the offer. I'm going to try and parse the data dumps and see how that goes.

black

Someone from routeviews.org emailed me back, he said to get http://archive.routeviews.org/oix-route-views/oix-full-snapshot-latest.dat.bz2 (it updates every 2 hours) it's pretty much the output of show ip bgp. From there, parse the file and you're good to go. I'm posting this just incase anyone else wants to do the same.

Also, I noticed that team-cymru's IP to ASN isn't that accurate (I'm not sure how often their datasets update), the dataset from routeviews is better (from a 2k random IP test).

If a mod wants to close this thread, that's fine with me or leave it open for discussion.

telephone

@black said:
Also, I noticed that team-cymru's IP to ASN isn't that accurate (I'm not sure how often their datasets update), the dataset from routeviews is better (from a 2k random IP test).

Mind sharing the % of inaccurate results?

black

telephone said: Mind sharing the % of inaccurate results?

I ran a sample of 2k random IPs, about 5 were inaccurate, but it's probably due to how frequent their database updates.