Origin ASN seen vs Origin ASN in Whois Records Report?
I don't know if a report like this already exists, but I haven't been able to find one. Can someone (CIDR Report? BGPMon? PCH?) offer a report that shows the discrepencies in Origin ASN according to the whois records, and routes in the [global/public] routing table? Publishing it on some regular interval would be even better. ARIN makes available a list of prefixes with OriginAS. I don't know if other RIR's do. ftp://ftp.arin.net/pub/originAS/ To be clear. I want a list of the prefixes where the actual origin ASN seen does not match the one in the whois record. Inconsistent Origin is fair game here. As a transit provider I'm interested in seeing what prefixes I am transiting for my customers that have this discrepancy, so something that shows the full path as part of the results would be most helpful. Thanks, --Heather -- ==================================================== Heather Schiller Verizon Business Customer Security 1.800.900.0241 IP Address Management help4u@verizonbusiness.com =====================================================
On Wed, 19 Nov 2008, Heather Schiller wrote: > I don't know if a report like this already exists, but I haven't been able > to find one. Can someone (CIDR Report? BGPMon? PCH?) offer a report that > shows the discrepencies in Origin ASN according to the whois records, and > routes in the [global/public] routing table? I'm pretty sure that we don't already generate that, though I'm checking to make sure. We do have all the necessary data sources already in our database and updated in real-time, so no problem to generate it. May take a day or two. -Bill
On Nov 19, 2008, at 4:16 PM, Heather Schiller wrote:
I don't know if a report like this already exists, but I haven't been able to find one. Can someone (CIDR Report? BGPMon? PCH?) offer a report that shows the discrepencies in Origin ASN according to the whois records, and routes in the [global/public] routing table?
http://www.pch.net/routing-origin-inconsistency/ From the help page: "This tool identifies inconsistencies between the autonomous systems which the Regional Internet Registries believe are authoritative origins for routing announcements of each IP address prefix, and those which are actually announcing the prefixes to PCH's global network of looking glasses. The tool produces two lists of inconsistent origins: the list at the top of the page, which contains prefixes that are being announced by ASNs apparently unrelated to the putatively-authoritative ones; and the list at the bottom of the page, which contains prefixes with minor or apparently harmless inconsistencies, mainly subsets of large authoritative sets, and different ASNs operated by the same organization."
Publishing it on some regular interval would be even better.
It's updated daily at midnight UTC. We don't presently spam any lists with our various reports and analyses. I guess we could add a subscription feature, though. -Bill
Andrew Partan just pointed out to me that this is somewhat less useful than it might be if the way we do our web apps were a little more fully documented. There are tool-tips on organization names, which show the actual AS numbers. And you can sort on any column by clicking on the column-heading. Click again to reverse the sort order. We'll add drill-down to show the actual AS-paths in the next day or two. -Bill
On 19 Nov 2008, at 19:16, Heather Schiller wrote:
ARIN makes available a list of prefixes with OriginAS. I don't know if other RIR's do.
How is that list generated? I'm not aware of any tight coupling between address assignment and AS assignment that binds anybody to advertise particular routes with particular origins, at least at the time that either is assigned/ allocated by an RIR/LIR. Without such a coupling, would a report along the lines that you suggest implicate the advertisement, or the "whois record" (whatever that means)? Joe
Joe Abley wrote:
On 19 Nov 2008, at 19:16, Heather Schiller wrote:
ARIN makes available a list of prefixes with OriginAS. I don't know if other RIR's do.
How is that list generated?
I'm not aware of any tight coupling between address assignment and AS assignment that binds anybody to advertise particular routes with particular origins, at least at the time that either is assigned/allocated by an RIR/LIR.
Presumably it's from the "Origin AS" field in WHOIS: http://www.arin.net/registration/templates/netmod.txt Template: ARIN-NET-MOD-4.1 ** As of February 2007 ** Detailed instructions are located below the template. 01. Registration Action (M or R): 02. IP Address and Prefix or Range: 03. Network Name: 04. Origin AS: ... 04. List all AS numbers from which the network may originate. You can list as many AS numbers as necessary. You must separate multiple AS numbers with a comma. You may not list AS number ranges; only list individual AS numbers. Interesting is how accurate the field actually is. Slide 6 at: http://www.arin.net/meetings/minutes/ARIN_XXII/PDF/friday/engineering_report... says that 91% of the routes they checked had a correct Origin AS in WHOIS, compared to 64% in the ARIN IRR database. S
On 23 Nov 2008, at 21:17, Stephen Sprunk wrote:
Presumably it's from the "Origin AS" field in WHOIS:
Ah, thanks (and also thanks to others who pointed that out off-list). That seems like a weird anachronism, to be honest. Perhaps it's only because nobody has ever tried to use it for anything that there's never been any reason for the ARIN community to propose that the collection of such information be stopped. Joe
Joe Abley wrote:
On 23 Nov 2008, at 21:17, Stephen Sprunk wrote:
Presumably it's from the "Origin AS" field in WHOIS:
Ah, thanks (and also thanks to others who pointed that out off-list).
That seems like a weird anachronism, to be honest. Perhaps it's only because nobody has ever tried to use it for anything that there's never been any reason for the ARIN community to propose that the collection of such information be stopped.
Joe
The policy is relatively new.. (Spring 2007) and adopted by the ARIN community after vetting at 2 meetings.. It's optional, so I can't imagine why anyone would propose that ARIN stop collecting this information. http://www.arin.net/policy/proposals/2006_3.html It may be that it's "newness" helps w/ the accuracy.. only time will tell. --heather ==================================================== Heather Schiller Verizon Business Customer Security 1.800.900.0241 IP Address Management help4u@verizonbusiness.com =====================================================
On 2008-11-24, at 13:10, Heather Schiller wrote:
Joe Abley wrote:
Presumably it's from the "Origin AS" field in WHOIS: Ah, thanks (and also thanks to others who pointed that out off-list). That seems like a weird anachronism, to be honest. Perhaps it's only because nobody has ever tried to use it for anything that
On 23 Nov 2008, at 21:17, Stephen Sprunk wrote: there's never been any reason for the ARIN community to propose that the collection of such information be stopped. Joe
The policy is relatively new..
Yep, thanks to you and the others who pointed that out privately. I think it's of limited utility, but this is not a policy list so I'm very happy to keep further reflections on that to myself :-) Joe
participants (4)
-
Bill Woodcock -
Heather Schiller -
Joe Abley -
Stephen Sprunk