Replies: 14 comments 19 replies
-
|
Hey @acoul, I see your point. On one hand, On the other hand, BGPView "hallucinates" and gives you a bad parent (117.192.0.0/10). I would argue that one good solution in this scenario would be something like this oneliner: which delivers what you're after: This is a suboptimal solution though, from a performance standpoint: it introduces a new API call to query IRR records for each and every prefix, which may become a nightmare for larger autonomous systems. This is why initially I went for a lighter approach (whois INETNUM deaggregation), which is sadly more error prone. If you have faster approaches or ideas, I'm open to suggestions! |
Beta Was this translation helpful? Give feedback.
-
appreciate so much your input, clarifications & technical detail I am still astound by the verity & usefulness asn packs & offers as a tool (utilizing various open services of the wonder netland) thank you |
Beta Was this translation helpful? Give feedback.
-
I haven't researched this thoroughly, but what is impressive about BGPView is the speed of the replies and the fact that it discovers registered network prefixes rather that just advertised ones (a bug or a feature depending what you are after)
I see and fully agree with your point let me provide some additional feedback, but if I am getting O.T. let me know and I will restrain myself trying to find the ASN of an IP with asn I get quite a quick response:
issuing though a query for analyzing ASN 179 is where the nightmare starts: it tries to retrieve & analyze information for 6217 prefixes which is a mission close (if you have the patience) to impossible of-course it works & after some time it properly displays correct & detailed information, but in my case it's an overkill. I find the following (not so professional) approach:
FWIW more handy |
Beta Was this translation helpful? Give feedback.
-
That's because they have the results cached on a server-side db, not fetched in real time. That's a minor tradeoff, but depending on your use case it may be absolutely acceptable.
BGPView is an amazing tool, but as I said earlier, it can give you misleading information when it comes to parent prefixes. Take for example output for AS 5505: ASN output:
BGPView outputSingle prefixes:Unique parents:Let's break those results down and compare the information we can derive from them:
Unfortunately when building As always, I'm fully open to suggestions or ideas! Thanks for the constructive issue. |
Beta Was this translation helpful? Give feedback.
-
|
the quality of the feedback reminds me my good old University days ! thank you accuracy & reliability comes first undoubtedly really grateful for the asn tool. I tend to use it when all quick alternatives fail and I am in a kind of a dead end state |
Beta Was this translation helpful? Give feedback.
-
|
I rushed to close this "ticket" overlooking the enhancement tag, thereof I am reopening it for further reference to whom it may concern as it also contains high quality information cheers |
Beta Was this translation helpful? Give feedback.
-
|
I've converted this issue to a discussion, I think it's a more appropriate place for anyone to contribute with ideas or APIs to improve this lookup workflow |
Beta Was this translation helpful? Give feedback.
-
|
my acquaintance with asn happened on a quest of trying to find ways to fight (or actually defend from) spam and various malicious port scans FWIW, I would like to share a few more findings (for me at least) that I bumped today for resolving IPs to ASNs along with their relative netblocks
Edit: Aug. 28, 2025
|
Beta Was this translation helpful? Give feedback.
-
|
Yes,
Note DNS is faster than WHOIS when querying Cymru, so you may want to use that for faster lookup |
Beta Was this translation helpful? Give feedback.
-
|
just a little update on my quest for a quick & efficient way for locating the origin of an IP hitting a little apache web-server there is a growing DDoS in my Internet presence on the net-land from bots, A.I. or from actual people that just enjoy playing & possibly earning through simply learning I am using iptables on a 32bit, 8GB Ram, J1900 Intel, Gentoo system for temporarily blacklisting some low importance misbehaving networks hitting the http ports at some-point iptables grew to the point of running out of memory the reason is that most of the blacklisted networks are /24 subnets, thereof temporary blacklisting their parent subnets would be a more efficient & in my case a one-way approach thereof at some intervals I manually run a script for converting the /24 subnets to their parent subnets wherever it's feasible searching in the net-land about this process, I bumped in-to the Cloudflare Radar which is quite interesting and I am sharing it here as a pointer & a future reference ipapi.is is quite interesting too with plenty of information. |
Beta Was this translation helpful? Give feedback.
-
|
Yes, Cloudflare Radar is a very valuable resource. ❯ asn -j 3354 | jq '.results[].bgp_hijack_incidents'
{
"total": 69,
"as_hijacker": 0,
"as_victim": 69
}If you have suggestions for futher usage of the Radar API, I'm open to feedback as always! |
Beta Was this translation helpful? Give feedback.
-
oh and I forgot, ipapi.is is the excellent API project by @NikolaiT. |
Beta Was this translation helpful? Give feedback.
-
|
old incolumitas.com API is now replaced by official Ipapi.is in 75b1c81 (v0.79.0), so DC+region identification is back (also added more org type id features exposed by ipapi.is) |
Beta Was this translation helpful? Give feedback.
-
|
thank you for the (always) valuable feedback the problem that I am facing with the DDoS, is the high amount of C-class subnets that they saturate the iptables memory here is an example for the
returns:
returns: |
Beta Was this translation helpful? Give feedback.
-
|
I hear ya, but unfortunately, that /19 aggregation is (technically speaking) wrong. The prefix list lacks the |
Beta Was this translation helpful? Give feedback.
-
|
just this ! |
Beta Was this translation helpful? Give feedback.
-
|
since I am in-to eagerly looking for the best method to aggregate IPv4 subnets, here is another one:
Edit: this looks like an ipapi.is issue, not asn's
|
Beta Was this translation helpful? Give feedback.
-
|
it's neither an Both your earlier (38.252.46.0/24) and later (38.3.228.0/24) examples involve networks which are, at the "highest" level, part of the same 38.0.0.0/8, a resource the competent RIR (ARIN in this case) allocated to AS174 (Cogent). Cogent then assigned parts of this big /8 to other organizations. In your examples, to AS328539 (Giga-Communication, an ISP in Lybia) and AS211908 (Horizon Scope, a MNO in Iraq). Ultimately, these two operators decide how to announce this space: in their case, they find it convenient to announce individual /24 prefixes. That's up to them to split their assignments down how they see fit in order to define their AS routing policies. Now tools like So each case is different as you can see, but this doesn't mean there's no solution. For example, Cogent operates a whois database that conveniently includes assignment ranges. You can leverage that knowledge and use it at your advantage to help build your iptables rules. For example: ❯ whois -h rwhois.cogentco.com:4321 38.252.46.0/24 | grep IP-Network | cut -d : -f3
38.252.32.0/19or ❯ whois -h rwhois.cogentco.com:4321 38.3.228.0/24 | grep IP-Network | cut -d : -f3
38.3.228.0/22And that's how you get the aggregation you asked for - in the specific case you're looking up networks that obtain their assignments from Cogent. Hope that helps. |
Beta Was this translation helpful? Give feedback.
-
|
very insightful, thank you FWIW,
|
Beta Was this translation helpful? Give feedback.
-
That
Tried the first two using So those give you larger parents (/22 and /23). If for others you can't find a larger supernet, it probably means the target AS operates just that single /24 in that range (like the example above), and it's not possible to aggregate further. |
Beta Was this translation helpful? Give feedback.
-
|
today I bumped in another case of
thereof
in such a case/scenario, would it help BTW, the |
Beta Was this translation helpful? Give feedback.
-
|
I am currently working on This unfortunately slows down the process more, hence why I am still figuring it out. Anyhow this also means some aggregation will be lost in the process (in the name, as usual, of exactness). For the above AS for example, new asn will give you this list: which is almost exactly identical to bgpview, with the only difference being bgpview reporting
I think this is an interesting use case, i.e.: looking up all routes, with max aggregation, belonging to a target AS and within a CIDR range (in your example ^194 which translates to 194.0.0.0/8). I'd really like a one-API-fits-all kinda thing too. That would make |
Beta Was this translation helpful? Give feedback.
-
maybe, at some-point, a quick & "dirty" option can be available for as a brainstorm, I looked at following time asn -4jn 203020 | jq -r '.results[].inetnums.v4[]' > /tmp/cidrs.txt2.56.228.0/22 real 48m7.480s using mapcidr I was able to get some aggragated networks from the above diff -Nrup /tmp/cidrs.txt_s /tmp/cidrs.txtA_s | grep -e \^- -e \^+--- /tmp/cidrs.txt_s 2025-09-04 19:20:28.745487068 +0300 Edit: a simpler illustration of asn -4jn 25893 | jq -r '.results[].inetnums.v4[]' | sort -V > /tmp/out_s45.38.53.0/24
alternatively to
|
Beta Was this translation helpful? Give feedback.
-
I will consider this. Whenever I get time, I try to come up with ways to speed up the prefix lookup process. There is a lot of room for improvement there, hence why I haven't pushed the latest beta yet
Good call. This way you will get the best of both worlds (max accuracy + max aggregation). Now what's needed is max speed :-) |
Beta Was this translation helpful? Give feedback.
-
|
FWIW, I just bumped onto as-ip-blocks I don't know if this project maybe of some use to asn BTW, bgpview.io was permanently shut down |
Beta Was this translation helpful? Give feedback.
-
|
Hey @acoul, thanks for the hint, I had noticed the repo before, I think it had a different name? I had it in my stars list already anyway. I'll give it another look and see if anything useful could come out of it! Also thanks for the heads up, didn't know about the bgpview situation. I think I have links to it in html mode, will have to remove them as soon as I get a chance. Cheers |
Beta Was this translation helpful? Give feedback.
-
indeed: as-ip-blocks (formerly asn-ip)
quite useful information & hints on their feedback section best regards |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
when querying an ASN for their prefixes, for example:
asn -n 38457the result (from HNS-AS-AP Honesty Net Solution I Pvt Ltd, IN) is:
when using bgpview.io for the same query, we get:
curl https://api.bgpview.io/asn/38457/prefixes | sed 's/parent":{"prefix":"/\n/g' | grep ^[1-9] | cut -d "\"" -f 1 | sort -u | sed 's/\\//'with the exception of the inclusion of the actual parent (provider) prefixes of that given ASN, which I haven't figured out (yet) a way to filter out:
bgpview.io provides one additional valid prefix for that given ASN
which is a valid parent of some of the /24 prefixes that the HNS-AS-AP provides
apparently, HNS-AS-AP seems to be missing the following valid prefixes:
Beta Was this translation helpful? Give feedback.
All reactions