atoomic / Net-Whois-IANA

Perl module to extract the descriptive whois information about various IPs
0 stars 3 forks source link

No Source and strange sources for some IPs found #25

Closed Skeeve closed 1 year ago

Skeeve commented 1 year ago

Hi.

I did some tests to find IPs served by AFRINIC and so I ran this "Oneliner"

perl -MNet::Whois::IANA -e '
    $iana = Net::Whois::IANA->new;
    for $ip (0..255) {
        print STDERR "\r$ip ";
        $iana->whois_query( -ip => "$ip.0.0.0");
        printf "%3d: %s\n", $ip, $iana->source;
    }
' > nics.txt

So testing 0.0.0.0 to 255.0.0.0.

I do not know whether or not that's a valid query, but I do hope so.

There are a few IPs the module find a source for: 168, 179, 180, 181, 186, 187, 189, 190, 191, 200, 201, 210, 220

But 168.0.0.0 for example seems to be related to LACNIC.

And I found three source not listed in the module's source:

IDNIC: 49, 116, 139, 182 JPNIC: 58, 118, 125, 211, 222 KRNIC: 59, 115, 123, 124

A quick test shows that, for example, 58.0.0.0 is served by APNIC, for all but the response which has as source "JPNIC".

Is this expected behaviour?

atoomic commented 1 year ago

To save some time, here is the current output from running that script at this day

╰─> perl -MNet::Whois::IANA -e '
    $iana = Net::Whois::IANA->new;
    for $ip (0..255) {
        print STDERR "\r$ip ";
        $iana->whois_query( -ip => "$ip.0.0.0");
        printf "%3d: %s\n", $ip, $iana->source;
    }
'
0   0: ARIN
1   1: APNIC APNIC
2   2: RIPE RIPE
3   3: ARIN
4   4: ARIN
5   5: RIPE RIPE RIPE
6   6: ARIN
7   7: ARIN
8   8: ARIN
9   9: ARIN
10  10: ARIN
11  11: ARIN
12  12: ARIN
13  13: ARIN
14  14: APNIC
15  15: ARIN
16  16: ARIN
17  17: ARIN
18  18: ARIN
19  19: ARIN
20  20: ARIN
21  21: ARIN
22  22: ARIN
23  23: ARIN
24  24: ARIN
25  25: RIPE # Filtered
26  26: ARIN
27  27: APNIC APNIC
28  28: ARIN
29  29: ARIN
30  30: ARIN
31  31: RIPE # Filtered RIPE # Filtered
32  32: ARIN
33  33: ARIN
34  34: ARIN
35  35: ARIN
36  36: APNIC
37  37: RIPE RIPE
38  38: ARIN
39  39: APNIC
40  40: ARIN
41  41: LACNIC
42  42: APNIC
43  43: APNIC APNIC
44  44: ARIN
45  45: ARIN
46  46: RIPE # Filtered RIPE # Filtered
47  47: ARIN
48  48: ARIN
49  49: IDNIC
50  50: ARIN
51  51: RIPE
52  52: ARIN
53  53: RIPE RIPE
54  54: ARIN
55  55: ARIN
56  56: ARIN
57  57: RIPE RIPE
58  58: JPNIC
59  59: KRNIC
60  60: LACNIC
61  61: APNIC APNIC
62  62: RIPE RIPE
63  63: ARIN
64  64: ARIN
65  65: ARIN
66  66: ARIN
67  67: ARIN
68  68: ARIN
69  69: ARIN
70  70: ARIN
71  71: ARIN
72  72: ARIN
73  73: ARIN
74  74: ARIN
75  75: ARIN
76  76: ARIN
77  77: RIPE # Filtered RIPE
78  78: RIPE RIPE
79  79: RIPE RIPE # Filtered
80  80: RIPE # Filtered RIPE # Filtered
81  81: RIPE # Filtered RIPE # Filtered
82  82: RIPE RIPE
83  83: RIPE RIPE
84  84: RIPE # Filtered RIPE # Filtered
85  85: RIPE # Filtered RIPE
86  86: RIPE RIPE
87  87: RIPE RIPE # Filtered
88  88: RIPE # Filtered RIPE
89  89: RIPE RIPE
90  90: RIPE RIPE
91  91: RIPE RIPE
92  92: RIPE RIPE # Filtered
93  93: RIPE RIPE
94  94: RIPE # Filtered RIPE # Filtered
95  95: RIPE # Filtered RIPE
96  96: ARIN
97  97: ARIN
98  98: ARIN
99  99: ARIN
100 100: ARIN
101 101: APNIC
102 102: LACNIC
103 103: APNIC APNIC
104 104: ARIN
105 105: LACNIC
106 106: APNIC
107 107: ARIN
108 108: ARIN
109 109: RIPE RIPE
110 110: LACNIC
111 111: APNIC APNIC
112 112: APNIC APNIC
113 113: APNIC APNIC
114 114: APNIC APNIC
115 115: KRNIC
116 116: IDNIC IDNIC
117 117: APNIC APNIC
118 118: JPNIC
119 119: APNIC
120 120: LACNIC
121 121: APNIC APNIC
122 122: APNIC
123 123: KRNIC
124 124: KRNIC
125 125: JPNIC
126 126: APNIC
127 127: ARIN
128 128: RIPE # Filtered RIPE
129 129: LACNIC
130 130: RIPE RIPE
131 131: LACNIC
132 132: ARIN
133 133: APNIC
134 134: RIPE RIPE
135 135: ARIN
136 136: ARIN
137 137: ARIN
138 138: LACNIC
139 139: IDNIC IDNIC
140 140: LACNIC
141 141: RIPE # Filtered RIPE
142 142: ARIN
143 143: LACNIC
144 144: APNIC
145 145: RIPE RIPE # Filtered
146 146: RIPE RIPE
147 147: ARIN
148 148: LACNIC
149 149: RIPE RIPE
150 150: LACNIC
151 151: RIPE RIPE
152 152: LACNIC
153 153: APNIC APNIC
154 154: LACNIC
155 155: LACNIC
156 156: LACNIC
157 157: APNIC APNIC
158 158: ARIN
159 159: RIPE RIPE
160 160: LACNIC
161 161: LACNIC
162 162: ARIN
163 163: APNIC APNIC
164 164: RIPE RIPE
165 165: LACNIC
166 166: ARIN
167 167: LACNIC
168 168: LACNIC
169 169: AFRINIC # Filtered AFRINIC # Filtered
170 170: LACNIC
171 171: APNIC APNIC APNIC APNIC
172 172: ARIN
173 173: ARIN
174 174: ARIN
175 175: APNIC
176 176: RIPE RIPE RIPE
177 177: LACNIC
178 178: RIPE RIPE
179 179: LACNIC
180 180: LACNIC
181 181: LACNIC
182 182: IDNIC IDNIC
183 183: APNIC
184 184: ARIN
185 185: RIPE
186 186: LACNIC
187 187: LACNIC
188 188: RIPE RIPE
189 189: LACNIC
190 190: LACNIC
191 191: LACNIC
192 192: ARIN
193 193: RIPE RIPE
194 194: RIPE RIPE # Filtered
195 195: RIPE # Filtered RIPE
196 196: AFRINIC # Filtered AFRINIC # Filtered
197 197: LACNIC
198 198: ARIN
199 199: ARIN
200 200: LACNIC
201 201: LACNIC
202 202: APNIC
203 203: APNIC
204 204: ARIN
205 205: ARIN
206 206: ARIN
207 207: ARIN
208 208: ARIN
209 209: ARIN
210 210: LACNIC
211 211: JPNIC
212 212: RIPE RIPE
213 213: RIPE # Filtered RIPE
214 214: ARIN
215 215: ARIN
216 216: ARIN
217 217: RIPE RIPE
218 218: APNIC APNIC
219 219: APNIC
220 220: LACNIC
221 221: APNIC APNIC
222 222: JPNIC
223 223: APNIC
224 224: ARIN
225 225: ARIN
226 226: ARIN
227 227: ARIN
228 228: ARIN
229 229: ARIN
230 230: ARIN
231 231: ARIN
232 232: ARIN
233 233: ARIN
234 234: ARIN
235 235: ARIN
236 236: ARIN
237 237: ARIN
238 238: ARIN
239 239: ARIN
240 240: ARIN
241 241: ARIN
242 242: ARIN
243 243: ARIN
244 244: ARIN
245 245: ARIN
246 246: ARIN
247 247: ARIN
248 248: ARIN
249 249: ARIN
250 250: ARIN
251 251: ARIN
252 252: ARIN
253 253: ARIN
254 254: ARIN
255 255: ARIN
atoomic commented 1 year ago

Regarding your question about 58.0.0.0 here is the output from the command line whois tool

╰─> whois 58.0.0.0
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '58.0.0.0 - 58.1.255.255'

% Abuse contact for '58.0.0.0 - 58.1.255.255' is 'hostmaster@nic.ad.jp'

inetnum:        58.0.0.0 - 58.1.255.255
netname:        InfoWeb
descr:          FUJITSU LIMITED
descr:          17-25, SHINKAMATA 1-CHOME, OTA-KU,
descr:          TOKYO 144-8588, JAPAN
country:        JP
admin-c:        JNIC1-AP
tech-c:         JNIC1-AP
status:         ALLOCATED PORTABLE
remarks:        Email address for spam or abuse complaints : abuse@web.ad.jp
mnt-by:         MAINT-JPNIC
mnt-irt:        IRT-JPNIC-JP
mnt-lower:      MAINT-JPNIC
last-modified:  2015-12-01T22:33:01Z
source:         APNIC

irt:            IRT-JPNIC-JP
address:        Uchikanda OS Bldg 4F, 2-12-6 Uchi-Kanda
address:        Chiyoda-ku, Tokyo 101-0047, Japan
e-mail:         hostmaster@nic.ad.jp
abuse-mailbox:  hostmaster@nic.ad.jp
phone:          +81-3-5297-2311
fax-no:         +81-3-5297-2312
admin-c:        JNIC1-AP
tech-c:         JNIC1-AP
auth:           # Filtered
remarks:        hostmaster@nic.ad.jp was validated on 2020-07-23
mnt-by:         MAINT-JPNIC
last-modified:  2022-06-14T04:26:58Z
source:         APNIC

role:           Japan Network Information Center
address:        Uchikanda OS Bldg 4F, 2-12-6 Uchi-Kanda
address:        Chiyoda-ku, Tokyo 101-0047, Japan
country:        JP
phone:          +81-3-5297-2311
fax-no:         +81-3-5297-2312
e-mail:         hostmaster@nic.ad.jp
admin-c:        JI13-AP
tech-c:         JE53-AP
nic-hdl:        JNIC1-AP
mnt-by:         MAINT-JPNIC
last-modified:  2022-01-05T03:04:02Z
source:         APNIC

% Information related to '58.0.0.0 - 58.0.0.255'

inetnum:        58.0.0.0 - 58.0.0.255
netname:        OCN-N
descr:          NTT Communications Corporation
country:        JP
admin-c:        JP00208756
tech-c:         JP00208756
remarks:        This information has been partially mirrored by APNIC from
remarks:        JPNIC. To obtain more specific information, please use the
remarks:        JPNIC WHOIS Gateway at
remarks:        http://www.nic.ad.jp/en/db/whois/en-gateway.html or
remarks:        whois.nic.ad.jp for WHOIS client. (The WHOIS client
remarks:        defaults to Japanese output, use the /e switch for English
remarks:        output)
last-modified:  2021-06-17T00:38:03Z
source:         JPNIC

% This query was served by the APNIC Whois Service version 1.88.16 (WHOIS-US3)
atoomic commented 1 year ago

We can see two answers one for 58.0.0.0 - 58.1.255.255 with source: APNIC and another one for 58.0.0.0 - 58.0.0.255 using source: JPNIC

atoomic commented 1 year ago

Indeed the current version of this packages is not aware of these sources idnic, jpnic, krnic it currently only handle: arin ripe apnic lacnic afrinic

Should not be that hard to extend the list, will have a look thanks

atoomic commented 1 year ago

IMO 58.0.0.0 source is JPNIC this is correct I do not think this task require any actions I can see adding some extra IANA servers to the module: idnic, jpnic, krnic