IP to ASN Mapping Service with History
There are several services on the Internet to map IP addresses to their corresponding BGP AS number like the renowned IP to ASN mapping of Team Cymru.
During incident handling, we were lacking an historical view of IP address announcement evolution over time. It is not uncommon to have IP addresses announced by different BGP AS number over a period of time. We developed a service, freely accessible to the whole community, to look up IP addresses announcements in the past. Currently, the service covers a time span of more than 4 years until today.
How to use the service?
The service can be accessed via WHOIS protocol (TCP 43) or HTTP. The WHOIS service is more convenient for scripting and produces less data overhead.
The WHOIS server is whois.circl.lu. The output format is an aggregated list of each period announcing the queried IP address.
The output format is the following:
- First time seen
- Last time see
- AS number
- Network block announced
- IP address queried part of the announced block
You can access the WHOIS server using a standard WHOIS client.
whois -h whois.circl.lu 18.104.22.168 20090922|20140401|15169|22.214.171.124/24|126.96.36.199 20090101|20090921|3356|188.8.131.52/9|184.108.40.206
In the example above, it’s a query for public Google DNS server 220.127.116.11. The server is part of an announce from Google starting from September 2009. Previously, the IP address was part of an announce from Level3.
whois -h whois.circl.lu 18.104.22.168 20130507|20140401|59584|22.214.171.124/22|126.96.36.199 20120821|20120821|9498|188.8.131.52/3|184.108.40.206 20110328|20111127|3303|220.127.116.11/2|18.104.22.168 20100524|20100602|237|22.214.171.124/8|126.96.36.199
If you don’t have WHOIS access from your location, you can still access the service via a web interface.
What do you do with announces of less than 1 day?
As the current system is importing BGP dumps daily, the precision is per day. There is ongoing development for keeping track of ephemeral announces of less than a day.
Is the software for this service publicly available?
The software is distributed as free software. The software is available on our GitHub repository.