search

hadiasghari / pyasn

Python IP address to Autonomous System Number lookup module. (Supports fast local lookups, and historical lookups using archived BGP dumps.)
Other
294 stars 72 forks source link

IP to ASN mapping for edge providers - difference with Cymru #16

Closed qblone closed 8 years ago

qblone commented 9 years ago

Pyasn provides AS1103 for IP:192.87.158.242 with prefix 192.87.0.0/16 when using ipasn_20150825.dat. This is the AS for Surfnet. Upon contacting Surfnet, they stated that they are the ISP for this range but it belongs to a customer of theirs, WKAPNET with AS1142 being the correct answer. (They aggregate it to /16 to advertise in BGP).

Team Cymru (http://asn.cymru.com/cgi-bin/whois.cgi) correctly identifies the AS; However RIPE, domaintools, maxmind and CAIDA all give the same answer as pyasn. Perhaps Team-Cymru supplements this with WHOIS registry information.

qblone commented 9 years ago

We tested another 2000 IPs, and found 3 differences in total (including the above). For the other cases, Team Cymru returns two AS as the results:

IP 209.11.233.202 => pyasn = AS31812; Cymru = AS22243, AS31812. (CAIDA maps to AS22243 which is upstream on H.E.)

IP 182.19.13.5 => pyasn = AS38266; Cymru = AS38266, AS55410; (CAIDA maps to AS55410 which is upstream on H.E.)

hadiasghari commented 9 years ago

Thanks qblone, I'll check into these. One of our unit-tests also noted a few differences with Team Cymru look up results, but we couldn't pinpoint the cause; it's great that you have ISP confirmation for the first IP address. Our hunch was that the difference lies in different BGP-views (where the BGP-data is collected), or in processing the BGP-AS-path. It might be as you say also that they supplement their data from other sources. I'll provide more information.

imaia commented 8 years ago

cymru now returns AS1103 as Surfnet, by the way.

hadiasghari commented 8 years ago

thanks @imaia , I'm closing this issue then.