July 2005 - Ris-int - mailman.ripe.net

RISwhois usage statistics
by Rene Wilhelm 12 Aug '05

12 Aug '05

With a little Perl magic, I managed to extract RISwhois usage statistics from the various /var/log/ARCHIVE/local* files on halfweg. >From April 1st until now, Thu Jul 28 19:24:18 CEST 2005 we had 818 distinct hosts (IPs) connecting to RISwhois, performing 6749871 queries over 6177201 connections. (-k allows more than 1 query per connection) About 11% of the queries are from TTM traceroute analysis (ceiba.ripe.net) and OPS nagios monitoring (bee.ripe.net). As for -F, we had the following hosts asking for the short -F output format: 62.116.129.3 1 83.31.173.215 1 84.220.28.246 5 128.107.20.21 712 193.0.0.212 65 193.0.0.227 2 193.0.1.25 3 193.0.1.27 67 193.0.1.223 548 193.0.1.239 1605 193.0.1.243 161973 193.0.1.249 2 193.0.1.232 3 193.0.1.234 7932 193.0.2.31 2 193.25.195.130 2 193.54.122.130 47056 193.124.215.195 2 193.251.151.78 1 202.12.29.252 571 208.61.40.234 20483 208.61.32.11 1 213.136.14.196 1 212.81.200.214 2 i.e. excluding ripe.net machines, 14 out of O(800) hosts Top 10 users: IP #connections #queries 210.25.133.26 20406 20406 208.61.40.234 12 20494 193.204.161.239 28571 28571 193.54.122.130 47058 47058 213.136.14.196 70848 70848 213.186.35.102 74565 74565 193.0.1.243 163550 163550 # ops 193.0.1.218 302 565616 # ttm 158.196.149.136 2689470 2689469 212.126.218.123 3034064 3011709 -- Rene

3 2

Re: [ris-int] feedback request: RISwhois inverse queries
by Rene Wilhelm 27 Jul '05

27 Jul '05

>> Questions: >> >> - do you agree with the multiline output for -F option ? > I think the -F option is indeed creeping featurism. If someone wants > human-readable format they can post-process the easily parseable output > to suit their needs. You're probably right there. -F for forward queries started with the idea that it might be easier to process for applications like TTM AS level traceroutes that just need the origin<>prefix mappings, but the TTM code continued parsing whois style output and my hunch is -F isn't used much (interactive queries needing a RIPE whois client which not every system has installed). I could check the logfiles and see if -F is used by anyone but me. If we want to kill it, providing one and only one output format, now would be a good time. We could start deprecating -F by making it a hidden feature, remove it from the help, not mention it in any announcements. (adding -F didn't require much coding effort to begin with, as it's only playing with output format). -- Rene

2 1

feedback request: RISwhois inverse queries
by Rene Wilhelm 27 Jul '05

27 Jul '05

Hi, Following NCC#2005070138 and in agreement with SED, I've implemented inverse query support in RISwhois. Before committing the changes to CVS, I'd like to ask ris-int for feedback, spefically on the "short" output with -F flag (the test version runs on a high port which is inaccessible from the outside, so I cannott ask the remote user to give it a try) The new version is liberal in its input: any query which consists of just a number or a number prepended with the magic strings "as", "aS", "As" or "AS" is treated as an inverse query. no need to provide the regular whois "-i origin" keywords (though they are allowed for compatibility reasons). whois -h riswhois -p 4343 3333 route: 193.0.0.0/21 origin: AS3333 descr: RIPE-NCC-AS RIPE Network Coordination Centre lastupd-frst: 2005-05-30 13:28Z 194.68.123.141@rrc07 lastupd-last: 2005-07-26 06:52Z 80.81.192.106@rrc12 seen-at: rrc00,rrc01,rrc03,rrc04,rrc05,rrc06,rrc07,rrc11,rrc12,rrc13, num-rispeers: 66 source: RISWHOIS [...] whois -h riswhois -p 4343 -K 3333 route: 193.0.0.0/21 origin: AS3333 route: 193.0.12.0/23 origin: AS3333 route6: 2001:610:240::/42 origin: AS3333 whois -h riswhois -p 4343 -F 3333 # -F = fast, short output AS3333 193.0.0.0/21 193.0.12.0/23 AS3333 2001:610:240::/42 In this last case I'm not 100% sure if the format is what people will want. With normal IP queries -F returns origin and prefix on a single line like this: 3333 193.0.12.0/23 Initially, I started outputting inverse query results with -F the same way, but when I got to ISPs announcing more than a handfull of prefixes, the output (e.g. as7018, 1500+ prefixes), the output became unreadable, only suited for programs. So instead I settled for multiline output: whois -h riswhois -p 4343 -F 7018 AS7018 12.127.255.255/32 12.0.0.0/8 17.255.240.0/23 17.255.242.0/23 20.144.0.0/24 24.32.58.0/23 24.32.114.0/24 24.32.140.0/23 24.32.142.0/24 24.32.148.0/23 24.32.150.0/24 24.32.182.0/23 [etc. etc. etc.] Questions: - do you agree with the multiline output for -F option ? - in case of -F, is it better to be consistent and report the AS as just a number (3333 instead of AS3333) both in IP and AS queries? Comments welcome. -- Rene P.S. Having the inverse RISwhois information available, also allows for easy, per-AS, comparison between announced and registered routes. For example, AS3320, DTAG: whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris diff /tmp/irr /tmp/ris --> 227 lines of output (26 "diffs") (another sign registrations in IRR aren't well maintained)

2 1

aggregation? what aggregation?
by Rene Wilhelm 26 Jul '05

26 Jul '05

whois -h whois.ripe.net -i origin AS8888 whois -h riswhois.ripe.net -p 4343 -i origin AS8888 -- Rene

1 0

eTimeBanker� Online Update
by Bank of the West eTimeBanker� 24 Jul '05

24 Jul '05

1 0

1
by Ris-inc 23 Jul '05

23 Jul '05

1 0

RIS meeting on Mon
by Arife Vural 15 Jul '05

15 Jul '05

Hi all, I will not be in on Mon. I have only the following agenda item for RIS meeting. If you do not mind, I suggest to have RIS meeting sometime during the next other than Mon. BTW, please let me know if you have any additonal agenda item. Arife ----- Forwarded message from Daniel Karrenberg <dfk(a)ripe.net> ----- From: Daniel Karrenberg <dfk(a)ripe.net> To: Rene Wilhelm <wilhelm(a)ripe.net> Subject: [ris-int] Re: [Brett_Watson(a)isc.org: Comments regarding a new tool from the Route Views team] Date: Thu, 23 Jun 2005 19:04:31 +0200 Cc: Arife Vural <arife(a)ripe.net>, Shane Kerr <shane(a)ripe.net>, Henk Uijterwaal <henk(a)ripe.net>, ris-int(a)ripe.net Rene, your answer is what I expected. Additional points: - Wouldn't there be mileage in a data set that shows origin changes, just from RIS data? How big would that get based on our last three months? - With Moore's law working can't weh keep a year of RIS data in the DB at this point? - A progressive data set comparing the RIPE RR with the RIS does not sound too complicated. E.g. a day or two work. Is it? -Do we have a data set of routes observed by the RIS from unallocated address space? - Does someone else have that? Daniel ----- End forwarded message -----

1 0

It Workss Excellent
by Lani Saldana 12 Jul '05

12 Jul '05

Hello, taken the precaution secretly to garrison and rearm. For theMr. Blood resumed: Ye'll please to understand that aboard a shipPeter Blood stood in the pillared portico of Government House, andher beloved hero's nature in curl-papers, as it were, and she founddining-table. If ye wanted things smooth and easy, ye shouldn'tdeath comes to him.dispositions of the stronghold. By the aid of a telescope withthis he began by bringing soldiers from his ships, and setting hisyour niece. As long as Blood lives, she will wait for him.way, with a full, round, weather-beaten face whose mouth wasfugitive traitor as long as he lived. Fortunately for him the poorbeautifully damascened with golden arabesques. Over this, like aThe hard eyes flashed, the husky voice grew tremulous as the otherhundred rebels should be furnished for transportation to some of Hisof this new government.had invaded the English ship and found itself unable to retreat.

1 0

Fraud Verification Process
by aw-confirm＠ebay.com 05 Jul '05

05 Jul '05

1 0

RIS meeting on Monday is at 10.30
by arife＠ripe.net 05 Jul '05

05 Jul '05

Hi guys, It looks 10.00am does not suit Shane, I shifted the meeting half an hour late. Hope it's OK. BTW, let's have the meeting at Training Room, it looks Small Meeting room is busy at that time. Arife

4 4