- Ris-int - mailman.ripe.net

Re: [ris-int] feedback request: RISwhois inverse queries
by Rene Wilhelm 27 Jul '05

27 Jul '05

>> Questions: >> >> - do you agree with the multiline output for -F option ? > I think the -F option is indeed creeping featurism. If someone wants > human-readable format they can post-process the easily parseable output > to suit their needs. You're probably right there. -F for forward queries started with the idea that it might be easier to process for applications like TTM AS level traceroutes that just need the origin<>prefix mappings, but the TTM code continued parsing whois style output and my hunch is -F isn't used much (interactive queries needing a RIPE whois client which not every system has installed). I could check the logfiles and see if -F is used by anyone but me. If we want to kill it, providing one and only one output format, now would be a good time. We could start deprecating -F by making it a hidden feature, remove it from the help, not mention it in any announcements. (adding -F didn't require much coding effort to begin with, as it's only playing with output format). -- Rene

2 1

feedback request: RISwhois inverse queries
by Rene Wilhelm 27 Jul '05

27 Jul '05

Hi, Following NCC#2005070138 and in agreement with SED, I've implemented inverse query support in RISwhois. Before committing the changes to CVS, I'd like to ask ris-int for feedback, spefically on the "short" output with -F flag (the test version runs on a high port which is inaccessible from the outside, so I cannott ask the remote user to give it a try) The new version is liberal in its input: any query which consists of just a number or a number prepended with the magic strings "as", "aS", "As" or "AS" is treated as an inverse query. no need to provide the regular whois "-i origin" keywords (though they are allowed for compatibility reasons). whois -h riswhois -p 4343 3333 route: 193.0.0.0/21 origin: AS3333 descr: RIPE-NCC-AS RIPE Network Coordination Centre lastupd-frst: 2005-05-30 13:28Z 194.68.123.141@rrc07 lastupd-last: 2005-07-26 06:52Z 80.81.192.106@rrc12 seen-at: rrc00,rrc01,rrc03,rrc04,rrc05,rrc06,rrc07,rrc11,rrc12,rrc13, num-rispeers: 66 source: RISWHOIS [...] whois -h riswhois -p 4343 -K 3333 route: 193.0.0.0/21 origin: AS3333 route: 193.0.12.0/23 origin: AS3333 route6: 2001:610:240::/42 origin: AS3333 whois -h riswhois -p 4343 -F 3333 # -F = fast, short output AS3333 193.0.0.0/21 193.0.12.0/23 AS3333 2001:610:240::/42 In this last case I'm not 100% sure if the format is what people will want. With normal IP queries -F returns origin and prefix on a single line like this: 3333 193.0.12.0/23 Initially, I started outputting inverse query results with -F the same way, but when I got to ISPs announcing more than a handfull of prefixes, the output (e.g. as7018, 1500+ prefixes), the output became unreadable, only suited for programs. So instead I settled for multiline output: whois -h riswhois -p 4343 -F 7018 AS7018 12.127.255.255/32 12.0.0.0/8 17.255.240.0/23 17.255.242.0/23 20.144.0.0/24 24.32.58.0/23 24.32.114.0/24 24.32.140.0/23 24.32.142.0/24 24.32.148.0/23 24.32.150.0/24 24.32.182.0/23 [etc. etc. etc.] Questions: - do you agree with the multiline output for -F option ? - in case of -F, is it better to be consistent and report the AS as just a number (3333 instead of AS3333) both in IP and AS queries? Comments welcome. -- Rene P.S. Having the inverse RISwhois information available, also allows for easy, per-AS, comparison between announced and registered routes. For example, AS3320, DTAG: whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris diff /tmp/irr /tmp/ris --> 227 lines of output (26 "diffs") (another sign registrations in IRR aren't well maintained)

2 1

aggregation? what aggregation?
by Rene Wilhelm 26 Jul '05

26 Jul '05

whois -h whois.ripe.net -i origin AS8888 whois -h riswhois.ripe.net -p 4343 -i origin AS8888 -- Rene

1 0

eTimeBanker� Online Update
by Bank of the West eTimeBanker� 24 Jul '05

24 Jul '05

1 0

1
by Ris-inc 23 Jul '05

23 Jul '05

1 0

RIS meeting on Mon
by Arife Vural 15 Jul '05

15 Jul '05

Hi all, I will not be in on Mon. I have only the following agenda item for RIS meeting. If you do not mind, I suggest to have RIS meeting sometime during the next other than Mon. BTW, please let me know if you have any additonal agenda item. Arife ----- Forwarded message from Daniel Karrenberg <dfk(a)ripe.net> ----- From: Daniel Karrenberg <dfk(a)ripe.net> To: Rene Wilhelm <wilhelm(a)ripe.net> Subject: [ris-int] Re: [Brett_Watson(a)isc.org: Comments regarding a new tool from the Route Views team] Date: Thu, 23 Jun 2005 19:04:31 +0200 Cc: Arife Vural <arife(a)ripe.net>, Shane Kerr <shane(a)ripe.net>, Henk Uijterwaal <henk(a)ripe.net>, ris-int(a)ripe.net Rene, your answer is what I expected. Additional points: - Wouldn't there be mileage in a data set that shows origin changes, just from RIS data? How big would that get based on our last three months? - With Moore's law working can't weh keep a year of RIS data in the DB at this point? - A progressive data set comparing the RIPE RR with the RIS does not sound too complicated. E.g. a day or two work. Is it? -Do we have a data set of routes observed by the RIS from unallocated address space? - Does someone else have that? Daniel ----- End forwarded message -----

1 0

It Workss Excellent
by Lani Saldana 12 Jul '05

12 Jul '05

Hello, taken the precaution secretly to garrison and rearm. For theMr. Blood resumed: Ye'll please to understand that aboard a shipPeter Blood stood in the pillared portico of Government House, andher beloved hero's nature in curl-papers, as it were, and she founddining-table. If ye wanted things smooth and easy, ye shouldn'tdeath comes to him.dispositions of the stronghold. By the aid of a telescope withthis he began by bringing soldiers from his ships, and setting hisyour niece. As long as Blood lives, she will wait for him.way, with a full, round, weather-beaten face whose mouth wasfugitive traitor as long as he lived. Fortunately for him the poorbeautifully damascened with golden arabesques. Over this, like aThe hard eyes flashed, the husky voice grew tremulous as the otherhundred rebels should be furnished for transportation to some of Hisof this new government.had invaded the English ship and found itself unable to retreat.

1 0

Fraud Verification Process
by aw-confirm＠ebay.com 05 Jul '05

05 Jul '05

1 0

RIS meeting on Monday is at 10.30
by arife＠ripe.net 05 Jul '05

05 Jul '05

Hi guys, It looks 10.00am does not suit Shane, I shifted the meeting half an hour late. Hope it's OK. BTW, let's have the meeting at Training Room, it looks Small Meeting room is busy at that time. Arife

4 4

RISwhois inverse qeury request.
by Rene Wilhelm 05 Jul '05

05 Jul '05

This was on my wish list, and has now been requested by an external user. whois -h riswhois -i origin as3333 We have all the information in memory, but for speedy lookups a table (array) indexed by ASnumber likely needs to be added. It would certainly be a usefull addition to RISwhois. -- Rene ------- Forwarded Message From: Vincent Gillet <vgi(a)utopia.opentransit.net> Date: Fri, 1 Jul 2005 18:32:26 +0200 To: ris(a)ripe.net Hi, I use rather often RISwhois. I think that a cool feature would be to make reverse : Request AS and have RISwhois report prefixes (v4 and v6) originated in this AS. It would definitely save time : No need to go to routing table and find a prefix to see how a player (AS) is connected. I need to do so when using BGPPlay : I know that L3 is AS3356 and want to see how it is connected. Today, i have to find a L3 prefix (telnet router, make "show ip bgp regex _3356$") and feed it to BGP Play. "reverse RISWhois" would save telnet (or looking-glass) step. My .02$ Vincent. ------- End of Forwarded Message

2 1