Hi, Following NCC#2005070138 and in agreement with SED, I've implemented inverse query support in RISwhois. Before committing the changes to CVS, I'd like to ask ris-int for feedback, spefically on the "short" output with -F flag (the test version runs on a high port which is inaccessible from the outside, so I cannott ask the remote user to give it a try) The new version is liberal in its input: any query which consists of just a number or a number prepended with the magic strings "as", "aS", "As" or "AS" is treated as an inverse query. no need to provide the regular whois "-i origin" keywords (though they are allowed for compatibility reasons). whois -h riswhois -p 4343 3333 route: 193.0.0.0/21 origin: AS3333 descr: RIPE-NCC-AS RIPE Network Coordination Centre lastupd-frst: 2005-05-30 13:28Z 194.68.123.141@rrc07 lastupd-last: 2005-07-26 06:52Z 80.81.192.106@rrc12 seen-at: rrc00,rrc01,rrc03,rrc04,rrc05,rrc06,rrc07,rrc11,rrc12,rrc13, num-rispeers: 66 source: RISWHOIS [...] whois -h riswhois -p 4343 -K 3333 route: 193.0.0.0/21 origin: AS3333 route: 193.0.12.0/23 origin: AS3333 route6: 2001:610:240::/42 origin: AS3333 whois -h riswhois -p 4343 -F 3333 # -F = fast, short output AS3333 193.0.0.0/21 193.0.12.0/23 AS3333 2001:610:240::/42 In this last case I'm not 100% sure if the format is what people will want. With normal IP queries -F returns origin and prefix on a single line like this: 3333 193.0.12.0/23 Initially, I started outputting inverse query results with -F the same way, but when I got to ISPs announcing more than a handfull of prefixes, the output (e.g. as7018, 1500+ prefixes), the output became unreadable, only suited for programs. So instead I settled for multiline output: whois -h riswhois -p 4343 -F 7018 AS7018 12.127.255.255/32 12.0.0.0/8 17.255.240.0/23 17.255.242.0/23 20.144.0.0/24 24.32.58.0/23 24.32.114.0/24 24.32.140.0/23 24.32.142.0/24 24.32.148.0/23 24.32.150.0/24 24.32.182.0/23 [etc. etc. etc.] Questions: - do you agree with the multiline output for -F option ? - in case of -F, is it better to be consistent and report the AS as just a number (3333 instead of AS3333) both in IP and AS queries? Comments welcome. -- Rene P.S. Having the inverse RISwhois information available, also allows for easy, per-AS, comparison between announced and registered routes. For example, AS3320, DTAG: whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris diff /tmp/irr /tmp/ris --> 227 lines of output (26 "diffs") (another sign registrations in IRR aren't well maintained)