Following last week's thread on nanog re: "traceroute with asn" the author of LFT traceroute, Victor Oppleman, approached me offering to add riswhois lookups to the next version of LFT. (see attached e-mail). Replacing "one-connection/one-query" lookups to RADB by lookups to RISwhois was done in a jiffy, but recognizing the potential of RISwhois, he continued spending time adding support for bulk queries (all queries over one connection) In this process it turned out there was a need for an additional riswhois option: a "-1" flag which restricts the output to one and only one route object per prefix. In combination with -M this flag ensures LFT receives at most one origin for each IP. Having checked various prefixes on the Moas page (http://www.ris.ripe.net/moas/moas.html), it does make sense to report only 1 origin for each IP: most of the time the second origin is either one with a handfull of ris peers, or a private AS. As the required modifications in riswhoisd weren't too difficult and I wanted to keep the momentum going ("het ijzer smeden als het heet is"), I took care of adapting riswhoisd last sunday and for testing purposes started it on halfweg's port 4444. Of course, I overlooked the default deny-all firewall rules, so had to wait 'till monday for Ops to punch a temporary hole to allow Victor to test his LFT-with-RISwhois development. (thanks Emil!) All tests were succesful, so now it's time to follow a proper installation procedure for new riswhoisd (will create a ticket with ris@ripe.net for that) Last but not least, I leave you with this quote from Victor: [...] I have things to attend to also, but I was just excited seeing as though the RIS is a cool (very cool) service/infrastructure and I think it may be the most trustworthy way of attaining this information with regard to the LFT user community. I really appreciate what you guys have done and I'm glad we can interoperate. -- Rene ========================================== From: Victor Oppleman <victor@oppleman.com> Subject: LFT & RISwhois Date: Tue, 15 Mar 2005 15:48:16 -0700 To: wilhelm@ripe.net Hi Rene, I just saw this note (a friend just forwarded to me). The new (as yet unreleased) version of LFT supports querying not only the RADB/IRR (formerly the default when using the -A (asn lookup) option), but also the pWhoIs project (sounds like the same thing RISwhois is doing--we wrote one too) OR Cymru (another source of prefix-based whois data). If you're using pWhoIs or Cymru, it's *really* fast because it can grab the ASNs in bulk (one connection/query) instead of one connection per each query. If you'd like, I'm happy to code in an option to use data from your project (RISwhois), I just hadn't heard of it yet. Does it support bulk queries or should I do it like I do with RADB/IRR and hit it once for each query? Thanks!

From: Rene Wilhelm <wilhelm@ripe.net> Date: Tue, 15 Mar 2005 05:57:03 -0700 To: <bep@whack.org> Cc: Ziggy David Lubowa <ziggy@trueafrican.com>, Joe Shen <joe_hznm@yahoo.com.sg>, Raymond Dijkxhoorn <raymond@prolocation.net>, NANGO <nanog@merit.edu> Subject: Re: Traceroute with ASN

...

| Doesnt look like you have to, below is the link to the tarball | | http://oppleman.com/dl/?file=lft-2.3.tar.gz |

According to the doc, it relies on RADB for its info, so it *might* not be as accurate as an actual BGP feed.

Indeed. That's why we've created "RISwhois" [1], a whois interface to the BGP data collected by RIPE NCC's RIS project [2]. You query riswhois.ripe.net like you'd query whois.ra.net, but the data returned are from active BGP feeds, not manually registered objects.

Since RISwhois uses the same format as RADB, it's trivial to have lft consult the RIS BGP tables: simply replace the string "whois.ra.net" by "riswhois.ripe.net" in the whois.c file and recompile.

-- Rene

[1] http://www.ripe.net/ripe/meetings/ripe-47/presentations/ripe47-eof- riswhois.pd f

[2] http://www.ripe.net/projects/ris/index.html

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Rene Wilhelm RIPE Network Coordination Centre Email: wilhelm@ripe.net Amsterdam, the Netherlands Phone: +31 20 535 4417 Fax: +31 20 535 4445 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-