ASN in use, but no whois data?
Hey folks, I'm looking at an ASN 394183 and I can't find any whois or other contact data. I've checked globally and then also ARIN directly and literally nothing as if it weren't registered. It's announcing prefixes, at least one of which is IRR invalid part of a larger old PSINET block, though, and I'm seeing them in the global routing table. Anyone have any idea how this could happen where an ASN is in use, transiting several major providers to the internet, but no whois data as if it didn't exist? Thanks, Matt Matt Harris|Infrastructure Lead 816-256-5446|Direct Looking for help? Helpdesk|Email Support We build customized end-to-end technology solutions powered by NetFire Cloud.
The AS customer could've churned from ARIN, freeing the ASN but leaving *technically* valid IRRs in databases such as RADb (which seems to be where they originate): https://i.imgur.com/r5xx7Y6.png ..thus allowing them to continue to announce their routes under that ASN as usual, even though technically it doesn't exist in the ARIN WHOIS. Phin On Fri, Feb 25, 2022 at 10:47 PM Matt Harris <matt@netfire.net> wrote:
Hey folks, I'm looking at an ASN 394183 and I can't find any whois or other contact data. I've checked globally and then also ARIN directly and literally nothing as if it weren't registered. It's announcing prefixes, at least one of which is IRR invalid part of a larger old PSINET block, though, and I'm seeing them in the global routing table.
Anyone have any idea how this could happen where an ASN is in use, transiting several major providers to the internet, but no whois data as if it didn't exist?
Thanks, Matt
Matt Harris | Infrastructure Lead 816‑256‑5446 | Direct Looking for help? *Helpdesk* <https://help.netfire.net/> | *Email Support* <help@netfire.net>
We build customized end‑to‑end technology solutions powered by NetFire Cloud.
Legacy lookup here ASHandle: AS394183 OrgID: ORCL-2 ASName: OROCKLLC-USA-ASN ASNumber: 394183 RegDate: 2015-07-01 Updated: 2015-07-01 Source: ARIN OrgID: ORCL-2 OrgName: Orange Rock Consulting, LLC CanAllocate: Street: 300 West Glenoaks Blvd., Suite 106 City: Glendale State/Prov: CA Country: US PostalCode: 91202 RegDate: 2014-11-26 Updated: 2014-11-26 OrgAbuseHandle: LEONJ4-ARIN OrgAdminHandle: LEONJ4-ARIN OrgNOCHandle: LEONJ4-ARIN OrgTechHandle: LEONJ4-ARIN Source: ARIN POCHandle: LEONJ4-ARIN IsRole: N LastName: Leon FirstName: John Street: 300 West Glenoaks Blvd., Suite 106 City: Glendale State/Prov: CA Country: US PostalCode: 91202 RegDate: 2014-11-24 Updated: 2020-12-01 MobilePhone: +1-714-782-4326 FaxPhone: +1-818-484-2010 OfficePhone: +1-800-253-6121 Mailbox: john@orockllc.com Source: ARIN --srs ________________________________ From: NANOG <nanog-bounces+ops.lists=gmail.com@nanog.org> on behalf of Phineas Walton <phin@phineas.io> Sent: Saturday, February 26, 2022 4:25:56 AM To: Matt Harris <matt@netfire.net> Cc: North American Network Operators' Group <nanog@nanog.org> Subject: Re: ASN in use, but no whois data? The AS customer could've churned from ARIN, freeing the ASN but leaving technically valid IRRs in databases such as RADb (which seems to be where they originate): https://i.imgur.com/r5xx7Y6.png ..thus allowing them to continue to announce their routes under that ASN as usual, even though technically it doesn't exist in the ARIN WHOIS. Phin On Fri, Feb 25, 2022 at 10:47 PM Matt Harris <matt@netfire.net<mailto:matt@netfire.net>> wrote: Hey folks, I'm looking at an ASN 394183 and I can't find any whois or other contact data. I've checked globally and then also ARIN directly and literally nothing as if it weren't registered. It's announcing prefixes, at least one of which is IRR invalid part of a larger old PSINET block, though, and I'm seeing them in the global routing table. Anyone have any idea how this could happen where an ASN is in use, transiting several major providers to the internet, but no whois data as if it didn't exist? Thanks, Matt [X] Matt Harris | Infrastructure Lead 816‑256‑5446 | Direct Looking for help? Helpdesk<https://help.netfire.net/> | Email Support<mailto:help@netfire.net> [https://netfire.net/Flag-United-States-of-America.jpg] We build customized end‑to‑end technology solutions powered by NetFire Cloud.
On Fri, 25 Feb 2022 16:45:33 -0600 Matt Harris <matt@netfire.net> wrote:
I'm looking at an ASN 394183 and I can't find any whois or other contact data. I've checked globally and then also ARIN directly and
It appears like it might be https://orocktech.com/ but not clear to me what happened with the contact data. John
On 20220225, at 23:45, Matt Harris <matt@netfire.net> wrote:
Hey folks, I'm looking at an ASN 394183 and I can't find any whois or other contact data.
First stop for info: bgp.tools! https://bgp.tools/as/394183#whois But yes, as others commented, looks like a ARIN-expired ASN... as long as one pay the bills at upstreams your data is safe ;) Greets, Jeroen
On Feb 26, 2022, at 12:07 AM, Jeroen Massar via NANOG <nanog@nanog.org> wrote:
On 20220225, at 23:45, Matt Harris <matt@netfire.net> wrote:
Hey folks, I'm looking at an ASN 394183 and I can't find any whois or other contact data.
Yeah, in the wake of our peering survey, we’ve been looking into this… A surprising number of ASNs responded to the survey, but then we ran into errors when we went to geo-code their response to a country using the whois. There are zombie ASes like this in ARIN and in the IANA not-yet-delegated pool, but not in the other four RIRs. -Bill
participants (6)
-
Bill Woodcock -
Jeroen Massar -
John Kristoff -
Matt Harris -
Phineas Walton -
Suresh Ramasubramanian