4

How does the traceroute -A command work? How does the program look up the ASN? On which protocols or databases does the query depend? Can I recreate the -A option?

I am using this version: Modern traceroute for Linux, version 2.0.18, Jun 30 2012.

2

A whois query is made for every IP returend.

Here is a manual example. Get one of the IPs of networkengineering.stackexchange.com

> host networkengineering.stackexchange.com
networkengineering.stackexchange.com has address 104.16.12.128
networkengineering.stackexchange.com has address 104.16.14.128
networkengineering.stackexchange.com has address 104.16.15.128
networkengineering.stackexchange.com has address 104.16.13.128
networkengineering.stackexchange.com has address 104.16.16.128

And check which AS the IP belongs to:

 > whois 104.16.12.128  | grep -i origin
 OriginAS:       AS13335

Whois outpus way more information. The protocol ist specified in RFC3912

Note that whois output of the regional registries differ and not all will provide the origin as. So traceroute -A will not provide AS informations for all addresses.

  • I don't think so. – user2964971 Sep 14 '15 at 9:04
  • LACNIC: whois 200.26.79.202, whois 200.32.33.54, whois 209.13.168.154, do not reveal the ASN. Neither does the tool at lacnic.net. The ASNs shown by traceroute are: 200.26.79.202 [AS4967/AS10834]; 200.32.33.54 [AS5648]; 209.13.168.154 [AS4926]. – user2964971 Sep 14 '15 at 9:05
  • APNIC: whois 202.108.38.254 does not reveal the ASN. Neither does the tool at apnic.net. But traceroute shows AS4808. On the contrary, querying whois 219.158.97.165 via the form at apnic.net shows an additional section: % Information related to '219.158.96.0/19AS4837'. That's the same ASN as identified by traceroute. Still, whois 219.158.97.165 does not reveal the ASN. – user2964971 Sep 14 '15 at 9:13
  • I've done all traceroutes again. On two hosts, using different ISPs. For each hop a Whois query is sent to 198.108.0.18. I could manually query each hop via jwhois -f -h 198.108.0.18 $IPv4. Searching the web for "198.108.0.18" whois did lead me to RADB. To sum it up: traceroute does not ask a RIR, as whois does without the -h option. – user2964971 Sep 14 '15 at 15:09
  • 1
    Okay: Would you please explain how traceroute -A is working? It must be some form of magic and the file as_lookups.c in the traceroute source code, where whois.radb.net is queried and the output is searched for "origin", must be fake and only there to confuse people. – Jens Link Mar 27 '17 at 11:30
1

--as-path-lookups is based on RADB IRR data, which may very well be incorrect/missing.

traceroute/as_lookups.c in traceroute-2.1.0 Dmitry Butskoy

/*
    Copyright (c)  2006, 2007           Dmitry Butskoy
                                        <buc@citadel.stu.neva.ru>
    License:  GPL v2 or any later

    See COPYING for the status of this software.
*/

#define DEF_RADB_SERVER         "whois.radb.net"
#define DEF_RADB_SERVICE        "nicname"
...
if (!ra_addr.sa.sa_family) {
    const char *server, *service;
    struct addrinfo *res;
    int ret;

    server = getenv ("RA_SERVER");
    if (!server)  server = DEF_RADB_SERVER;

    service = getenv ("RA_SERVICE");
    if (!service)  service = DEF_RADB_SERVICE;


    ret = getaddrinfo (server, service, NULL, &res);
    if (ret) {
        fprintf (stderr, "%s/%s: %s\n", server, service,
                                            gai_strerror(ret));
        exit (2);
    }   

    memcpy (&ra_addr, res->ai_addr, res->ai_addrlen);

    freeaddrinfo (res);
}
...

example of incorrect information

  * 203.208.171.202 (203.208.171.202) [AS19905]  180.570 ms 203.208.153.254 (203.208.153.254) [AS19905]  187.246 ms

based on RADB IRR

$ whois -h whois.radb.net 203.208.171.202
route:      203.208.171.0/24
descr:      AC_SINGTEL
origin:     AS19905
mnt-by:     MAINT-AS7786
changed:    wan.engineering@neustar.biz 20150730  #02:53:10Z
source:     RADB

IRR/BGP comparison on IRR Explorer

  • 203.208.128.0/17 BGP from AS7473, RADB AS7473
  • 203.208.171.0/24 not seen in BGP, Level3 AS19905, RADB AS7473 the
  • traceroute hop 203.208.171.202 is actually in AS7473

Moral of the story, there is no way to reliable get a route's origin AS in any static database (IRR, registry etc). And the origin may very well be different depending on your vantage point in DFZ.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.