feedback request: RISwhois inverse queries
Hi, Following NCC#2005070138 and in agreement with SED, I've implemented inverse query support in RISwhois. Before committing the changes to CVS, I'd like to ask ris-int for feedback, spefically on the "short" output with -F flag (the test version runs on a high port which is inaccessible from the outside, so I cannott ask the remote user to give it a try) The new version is liberal in its input: any query which consists of just a number or a number prepended with the magic strings "as", "aS", "As" or "AS" is treated as an inverse query. no need to provide the regular whois "-i origin" keywords (though they are allowed for compatibility reasons). whois -h riswhois -p 4343 3333 route: 193.0.0.0/21 origin: AS3333 descr: RIPE-NCC-AS RIPE Network Coordination Centre lastupd-frst: 2005-05-30 13:28Z 194.68.123.141@rrc07 lastupd-last: 2005-07-26 06:52Z 80.81.192.106@rrc12 seen-at: rrc00,rrc01,rrc03,rrc04,rrc05,rrc06,rrc07,rrc11,rrc12,rrc13, num-rispeers: 66 source: RISWHOIS [...] whois -h riswhois -p 4343 -K 3333 route: 193.0.0.0/21 origin: AS3333 route: 193.0.12.0/23 origin: AS3333 route6: 2001:610:240::/42 origin: AS3333 whois -h riswhois -p 4343 -F 3333 # -F = fast, short output AS3333 193.0.0.0/21 193.0.12.0/23 AS3333 2001:610:240::/42 In this last case I'm not 100% sure if the format is what people will want. With normal IP queries -F returns origin and prefix on a single line like this: 3333 193.0.12.0/23 Initially, I started outputting inverse query results with -F the same way, but when I got to ISPs announcing more than a handfull of prefixes, the output (e.g. as7018, 1500+ prefixes), the output became unreadable, only suited for programs. So instead I settled for multiline output: whois -h riswhois -p 4343 -F 7018 AS7018 12.127.255.255/32 12.0.0.0/8 17.255.240.0/23 17.255.242.0/23 20.144.0.0/24 24.32.58.0/23 24.32.114.0/24 24.32.140.0/23 24.32.142.0/24 24.32.148.0/23 24.32.150.0/24 24.32.182.0/23 [etc. etc. etc.] Questions: - do you agree with the multiline output for -F option ? - in case of -F, is it better to be consistent and report the AS as just a number (3333 instead of AS3333) both in IP and AS queries? Comments welcome. -- Rene P.S. Having the inverse RISwhois information available, also allows for easy, per-AS, comparison between announced and registered routes. For example, AS3320, DTAG: whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris diff /tmp/irr /tmp/ris --> 227 lines of output (26 "diffs") (another sign registrations in IRR aren't well maintained)
On 26.07 18:10, Rene Wilhelm wrote:
Following NCC#2005070138 and in agreement with SED, I've implemented inverse query support in RISwhois.
Great!
Questions:
- do you agree with the multiline output for -F option ?
I think the -F option is indeed creeping featurism. If someone wants human-readable format they can post-process the easily parseable output to suit their needs. Having said that - I had to - and given that we already have -F for forward queries: If the goal is human-readable output, the line breaks have to be there, don't they?
- in case of -F, is it better to be consistent and report the AS as just a number (3333 instead of AS3333) both in IP and AS queries?
I think consistency is the higher goal here. There is little chance of a single integer being mis-read as a prefix.
P.S. Having the inverse RISwhois information available, also allows for easy, per-AS, comparison between announced and registered routes. For example, AS3320, DTAG:
whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr
whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris
diff /tmp/irr /tmp/ris
--> 227 lines of output (26 "diffs")
(another sign registrations in IRR aren't well maintained)
Making this into a script and publishing it is a good idea. Making this available as a CGI on the RIS pages is also good. Daniel
participants (2)
-
Daniel Karrenberg -
Rene Wilhelm