Differences

This shows you the differences between two versions of the page.

--- fuss:networking [2017/02/22 18:30] – external edit 127.0.0.1
+++ fuss:networking [2018/08/03 09:11] – [Determining Open Outbound Ports] office
@@ Line 266: / Line 266: @@
   * ''-Pn'' tells ''nmap'' not to ping and just to connect
   * ''--reason'' will make ''nmap'' explain why a port was considered closed
+====== Determine ISP Address Blocks ======
+Either starting from a hostname, for instance ''tb1060.lon.100tb.com'' by issuing:
+<code bash>
+nslookup tb1060.lon.100tb.com
+</code>
+to determine the IP address, or from the IP address itself (in this case, ''146.185.28.59''), [[http://www.radb.net|RADb]] can be used to determine an ISP's address block.
+First, lookup the IP itself to determine which ISP it belongs to:
+<code bash>
+whois 146.185.28.59
+</code>
+Then, lookup the Autonomous System (AS) number (an ISP identifier code, if you will) of that ISP:
+<code bash>
+whois -h whois.radb.net 146.185.28.59 | grep ^origin
+</code>
+which should output:
+<code>
+origin:          AS29302
+</code>
+There may be more AS numbers for small internet providers that are, in turn, customers of a larger network.
+To make sure that the IP you are after is part of the AS, lookup the AS itself:
+<code bash>
+whois AS29302
+</code>
+and make sure that the ISP is listed.
+The final step is to get all known routes for the AS:
+<code bash>
+whois -h whois.radb.net -- -i origin -T route AS29302 | grep ^route | awk '{ print $2 }'
+</code>
+which should output all IPv4 address blocks allocated to that ISP line-by-line (easy to automate):
+<code bash>
+.185.16.0/20
+</code>
+IPv6 can also be queried in the same way:
+<code bash>
+whois -h whois.radb.net -- -i origin -T route6 AS29302 | grep ^route | awk '{ print $2 }'
+</code>
+and will yield similar results:
+<code bash>
+a01:5a80::/32
+</code>