aboutsummaryrefslogtreecommitdiff
asn: map hosts to their corresponding ASN via HTTP/WHOIS

usage: asn.py [-h] [--bind-whois-v4 WHOIS_V4] [--bind-whois-v6 WHOIS_V6] [--bind-whois-port WHOIS_PORT]
              [--bind-http-v4 HTTP_V4] [--bind-http-v6 HTTP_V6] [--bind-http-port HTTP_PORT] [--update] [--populate]

options:
  -h, --help            show this help message and exit
  --bind-whois-v4 WHOIS_V4
                        WHOIS IPv4 host (default: 127.0.0.1)
  --bind-whois-v6 WHOIS_V6
                        WHOIS IPv6 host (default: ::1)
  --bind-whois-port WHOIS_PORT
                        WHOIS port (default: 4343)
  --bind-http-v4 HTTP_V4
                        HTTP IPv4 host (default: 127.0.0.1)
  --bind-http-v6 HTTP_V6
                        HTTP IPv6 host (default: ::1)
  --bind-http-port HTTP_PORT
                        HTTP port (default: 8080)
  --update              Update dataset submodule and create/populate cache (default: False)
  --populate            Create and populate cache from current dataset (default: False)

INSTALL

  $ git submodule init
  $ git submodule update --recursive --remote

  $ doas apk add py3-gitpython py3-waitress py3-flask (Alpine)
  $ ./asn.py --populate
  $ ./asn.py

optional: forward traffic destined for port 43 (WHOIS default) back to 4343

  $ iptables -A PREROUTING -t nat -p tcp --dport 43 -j REDIRECT --to-ports 4343

USAGE

  $ whois -h 127.0.0.1 1.1.1.1

  IP Address | AS Number | Country | AS Name       | Announcement
  -----------+-----------+---------+---------------+-------------
  1.1.1.1    | 13335     | AU      | CLOUDFLARENET | 1.1.1.0/24

  $ whois -h 127.0.0.1 jordan.im

  IP Address        | AS Number | Country | AS Name           | Announcement
  ------------------+-----------+---------+-------------------+---------------
  185.73.44.145     | 8943      | GB      | Jump Networks Ltd | 185.73.44.0/22
  2001:ba8:0:4031:: | 8943      | GB      | Jump Networks Ltd | 2001:ba8::/32

  $ curl 127.0.0.1:8080

  {
    "host": "8.8.8.8",
    "hostname": "dns.google",
    "org": "AS15169 GOOGLE",
    "announcement": "8.8.8.0/24"
  }