{"id":1547,"date":"2022-01-13T22:25:01","date_gmt":"2022-01-13T22:25:01","guid":{"rendered":"https:\/\/www.ishygddt.xyz\/~blog\/?p=1547"},"modified":"2022-03-08T13:58:12","modified_gmt":"2022-03-08T19:58:12","slug":"whois-look-up-asn-from-the-command-line","status":"publish","type":"post","link":"http:\/\/www.ishygddt.xyz\/~blog\/2022\/01\/whois-look-up-asn-from-the-command-line","title":{"rendered":"[DRAFT] WHOIS: look up ASN from the command-line"},"content":{"rendered":"<p><a href=\"https:\/\/github.com\/rfc1036\/whois\/commit\/b49ba5ecc0f66dc53a7e1b0eb26d3a01da1c89e6\">Since<\/a> Marco d'Itri's <code class=\"\" data-line=\"\">whois(1)<\/code> v5.5.0 released in July 2019, most sysadmins no longer need to do trial-and-error or detectivework to guess which of the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Regional_Internet_registry\">5 <abbr title=\"Regional Internet Registry\">RIR<\/abbr>s<\/a> controls the IP attacking you and then hunt down the appropriate WHOIS server\u2014the <code class=\"language-sh\" data-line=\"\">-I<\/code> flag will now do that annoying accounting on your behalf:<\/p>\n<blockquote><p><dfn><code class=\"language-sh\" data-line=\"\">-I<\/code><\/dfn> First query <code class=\"\" data-line=\"\">whois.iana.org<\/code> and then follow its referral to the whois server authoritative for that request. This works for IP addresses, AS numbers[,] and domains. <strong>BEWARE:<\/strong> this implies that the IANA server will receive your complete query.<\/p><\/blockquote>\n<p>a bare-bones example:<\/p>\n<pre><code class=\"language-bash\" data-line=\"\">whois -a -I 1.1.1.1 | grep -i -E &#039;^origin&#039;<\/code><\/pre>\n<p>and, for a <em>highly<\/em> applied example:<\/p>\n<pre><code class=\"language-bash\" data-line=\"\">dig +short archive.is \\\n| xargs -n 1 whois -a -I \\\n| sed -n &#039;s\/^[Oo]rigin\\(AS\\)\\?:\\s\\+\\(AS[0-9]\\+\\)$\/\\2\/p&#039; | uniq \\\n| xargs -n 1 whois -I \\\n| less -F<\/code><\/pre>\n<p>(OpenBSD has supported this <a href=\"https:\/\/github.com\/openbsd\/src\/commit\/e8aeae690dcaf16b34fdd79bb1b94a264830208a\">since<\/a> <code class=\"\" data-line=\"\">whois(1)<\/code> v1.34, released in November 2004; FreeBSD has supported this <a href=\"https:\/\/cgit.freebsd.org\/src\/commit\/?id=7138e3fe154d72c677386b91355f46c325bcaf5b\">since<\/a> Release 11.0.0, released in October 2016; NetBSD has supported this <a href=\"https:\/\/github.com\/NetBSD\/src\/commit\/56096139f74fc680e9f374eb86ae4048690d0001\">since<\/a> <code class=\"\" data-line=\"\">whois(1)<\/code> v1.27, released in February 2020.)<\/p>\n<h2>Without <code class=\"language-sh\" data-line=\"\">-I<\/code><\/h2>\n<p>If you want to eschew the IANA query and \"DIY\" it by brute force, here's the key to that:<\/p>\n<pre><code class=\"language-bash\" data-line=\"\">for h in whois.arin.net whois.ripe.net whois.apnic.net whois.lacnic.net;\n  do whois -a -h &quot;$h&quot; 200.3.14.10 \\\n  | grep -i -E &#039;^origin&#039; &amp;&amp; break;\ndone<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Since Marco d'Itri's whois(1) v5.5.0 released in July 2019, most sysadmins no longer need to do trial-and-error or detectivework to guess which of the 5 RIRs controls the IP attacking you and then hunt down the appropriate WHOIS server\u2014the <code class=\"language-sh\" data-line=\"\">-I<\/code> flag will now do that annoying accounting on your behalf<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,101],"tags":[81,80,79],"class_list":["post-1547","post","type-post","status-publish","format-standard","hentry","category-drafts","category-writeups","tag-as-number","tag-iana","tag-whois"],"_links":{"self":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts\/1547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/comments?post=1547"}],"version-history":[{"count":33,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts\/1547\/revisions"}],"predecessor-version":[{"id":2077,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts\/1547\/revisions\/2077"}],"wp:attachment":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/media?parent=1547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/categories?post=1547"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/tags?post=1547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}