Whois

Linking AS-SETs and ASNs:

# There is a 1:N relationship between aut-num and as-set in IRR data.
# RIPE (for example) don't allow a search by AS number for the AS-SET:
# whois -h whois.ripe.net -T as-set -i members AS51551 # This Fails.
#
# One option is to get the maintainer of the ASN and search for AS-SETs with the same maintainer:
$ whois -h whois.ripe.net -T aut-num -r AS51551 | grep mnt-by | grep -v RIPE-NCC
mnt-by:         MNT-UPDATA

$ whois -h whois.ripe.net -T as-set -r -i mnt-by MNT-UPDATA | grep as-set
as-set:         AS-UPDATA
as-set:         AS-exNMS

# If the network has a peeringDB entry, at the time of writing, PeeringDB only allows one AS-SET to be stored:
$ whois -h whois.peeringdb.com AS51551 | grep AS-SET
IRR AS-SET           : RIPE::AS-UPDATA

# IRR Explorer shows all AS-SETs an AS belongs to:
https://irrexplorer.nlnog.net/api/sets/member-of/AS51551

# One can also reverse lookup AS numbers by maintainer:
$ whois -h rr.ntt.net -T aut-num -r -i mnt-by EQUINIX-MNT | grep aut-num | wc -l
37

# All downstream ASNs in the AS-SET
$ whois -h whois.ripe.net -T as-set AS-UPDATA | grep members
members:        AS51551
members:        AS47797
members:        AS199870
members:        AS201941
members:        AS196744
members:        AS44971
members:        AS44442
members:        AS49728

 

Whois Sources:

# Search for an AS-SET from a specific source database:
$whois -h a.private.irr.mirror.net -s ARIN AS-GOOGLE
Warnung: RIPE-Flags wurden mit einem »traditionellen« Server verwendet.
%  No entries found for the selected source(s).

$whois -h a.private.irr.mirror.net -s RIPE AS-GOOGLE
Warnung: RIPE-Flags wurden mit einem »traditionellen« Server verwendet.
as-set:         AS-GOOGLE
tech-c:         DUMY-RIPE
admin-c:        DUMY-RIPE
mnt-by:         IshmeetT_29-MNT
created:        2022-10-07T16:11:37Z
last-modified:  2022-10-07T16:11:37Z
source:         RIPE

$whois -h a.private.irr.mirror.net -s RADB AS-GOOGLE
Warnung: RIPE-Flags wurden mit einem »traditionellen« Server verwendet.
as-set:         AS-GOOGLE
descr:          Google
members:        AS11344
members:        AS15169
members:        AS6432
...
mnt-by:         MAINT-AS15169
changed:        radb-contact@google.com 20191204
source:         RADB

 

Routes:

# Which AS announces a route
$ whois -h whois.ripe.net -T route 89.21.224.0/19 grep origin
origin:         AS41695

# Print all the IPv4 and IPv6 routes that *could* be announce by an ASN:
whois -h whois.ripe.net -T route,route6 -i origin 41695

# Print all the IPv4 and IPv6 routes thare *are* being announced by an ASN:
curl https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS41695
curl https://bgpstuff.net/sourced?as=41695\&format=json

# Print all the IPv4 routes that *could* be announced by all the ASNs in the AS-SET
$ for ASN in `whois -h whois.ripe.net -T as-set AS-UPDATA | grep members`; do whois -h whois.ripe.net -T route -i origin $ASN | grep route: | awk '{print $2}'; done

# Print all the IPv6 routes that *could* be announced by all the ASNs in the AS-SET
$ for ASN in `whois -h whois.ripe.net -T as-set AS-UPDATA | grep members`; do whois -h whois.ripe.net -T route6 -i origin $ASN | grep route6: | awk '{print $2}'; done

 

History:

# See what changed in an AS-SET using version history (not supported by all RIRs/IRR DBs):
whois -h whois.ripe.net AS-VOSTRON --list-versions
whois -h whois.ripe.net AS-VOSTRON --show-version 4
whois -h whois.ripe.net AS-VOSTRON --diff-versions 3:4

 

Nameservers:

# Find the nameserver(s) for reverse DNS lookups of a downstream customer IP range:
whois AS51551 | grep -A 4 HGFL
remarks: HGFL
import: from AS199870 accept ANY
export: to AS199870 announce ANY
remarks: --------------------------------

whois -h whois.ripe.net -T route -i origin AS199870 | grep route
route: 46.16.0.0/21

whois -h whois.ripe.net -T domain 0.0.16.46.in-addr.arpa. | grep -v "%"
domain: 0.16.46.in-addr.arpa
nserver: ld4-sl1.hertsgfl.org.uk
nserver: ld5-sl1.hertsgfl.org.uk
nserver: ld4-sl2.hertsgfl.org.uk
nserver: ld5-sl2.hertsgfl.org.uk

 

Level3 filtergen:

# Check the IP prefix filters that Level3 builds automatically based off of IRR database data, for a specific AS number of AS-SET
$ whois -h filtergen.level3.net RIPE::AS51551
$ whois -h filtergen.level3.net RIPE::AS-UPDATA

# To specify multiple source DBs use "-searchpath"
$ whois -h filtergen.level3.net -- "-searchpath=RIPE;ARIN;APNIC;AFRINIC;LACNIC;RADB AS51551"

# By default filtergen responds with IPv4 prefixes only. Use "-v6" for v6 only or "-v4v6" for both:
$ whois -h filtergen.level3.net "RIPE::AS51551 -v6"
$ whois -h filtergen.level3.net "RIPE::AS51551 -v4v6"

# Use "-cp" to output a Cisco IOS style prefix filter. Use "-le=" to set a maximum size for matching prefixes.
$ whois -h filtergen.level3.net "RIPE::AS51551 -cp -le=32"
!
! Cisco prefix list for policy RIPE::AS51551 = 
!  RIPE::AS51551 
!
! Pre-aggregation prefix counts (IPv4,IPv6): 8, 0
ip prefix-list my-prefix-list seq  5 permit 46.16.0.0/21 le 32
ip prefix-list my-prefix-list seq 10 permit 46.183.192.0/21 le 32
ip prefix-list my-prefix-list seq 15 permit 82.203.32.0/19 le 32
ip prefix-list my-prefix-list seq 20 permit 82.203.64.0/18 le 32
ip prefix-list my-prefix-list seq 25 permit 185.26.16.0/22 le 32
ip prefix-list my-prefix-list seq 30 permit 185.137.192.0/22 le 32
ip prefix-list my-prefix-list seq 35 permit 185.137.196.0/22 le 32
ip prefix-list my-prefix-list seq 40 permit 195.190.22.0/24 le 32
ip prefix-list my-prefix-list seq 45 deny 0.0.0.0/0 le 32

# Help is supposedly available via "whois -h filtergen.level3.net help" but doesn't work from my non-Level3 connection?

# What do these two options do?
-recurseok
-warnonly

---