Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to pop up.
Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses?
Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses?
Using Facebook as an example... We police their bandwidth to a small fraction of our total directly on our ASA (because another group in the company owns the web-proxy).
I normally lookup the ASN of the company (Facebook is 32934), then I go to http://as.robtex.com/as32934.html#bgp and find their prefixes.
From that list, I build a Cisco ASA object group, which I can use to classify traffic... This is what I'm using now... Facebook gets throttled to a small amount of bandwidth... It works very well.
Every so often, you'll have to go back and check robtex AS-info to see whether they have added or removed prefixes. I usually try to take the largest aggregate block they have, even if they are only announcing smaller blocks from that larger aggregate.
object-group AS32934_Facebook
network-object 31.13.24.0 255.255.248.0
network-object 31.13.64.0 255.255.192.0
network-object 66.220.144.0 255.255.240.0
network-object 69.63.176.0 255.255.240.0
network-object 69.171.224.0 255.255.224.0
network-object 74.119.76.0 255.255.252.0
network-object 103.4.96.0 255.255.252.0
network-object 173.252.64.0 255.255.192.0
network-object 204.15.20.0 255.255.252.0
The python code I use to generate the list is trivial...
from ipaddr import IPv4Network, CollapseAddrList
fb_nets = list()
with open('facebook_nets.txt') as fh:
for line in fh:
net = IPv4Network(line.strip())
fb_nets.append(net)
print "object-group AS32934_Facebook"
for net in sorted(CollapseAddrList(fb_nets)):
print " network-object %s %s" % (net.network, net.netmask)
The code assumes you put all their prefixes in a text file called "facebook_nets.txt", with one prefix per line...
(py26_dfl)[mpenning@Bucksnort ~]$ head facebook_nets.txt
31.13.24.0/21
31.13.64.0/18
31.13.64.0/19
31.13.64.0/24
31.13.65.0/24
31.13.66.0/24
31.13.67.0/24
31.13.68.0/24
31.13.69.0/24
31.13.70.0/24
(py26_dfl)[mpenning@Bucksnort ~]$
Actually my script automatically web-scrapes the info every week, but this is a simplified version.
There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: nslookup facebook.com.
This gives you the associated IP address to that DNS name; in this case, 173.252.110.27 was the answer from my DNS server.
Then run a "whois" lookup for that IP address (you can go to Whois.net if you don't have a whois tool in your command line): whois 173.252.110.27
The relevant output in this case is:
NetRange: 173.252.64.0 - 173.252.127.255
CIDR: 173.252.64.0/18
OriginAS: AS32934
NetName: FACEBOOK-INC
Facebook has been assigned the entire /18 block of 173.252.64.0/18, so simply use that range for your ACL.
Note: With all of that stated, blocking by IP can become cumbersome very quickly, and is highly ineffective in many cases. Organizations the size of Facebook will constantly be adding new IP space, which will be outside of your filtered range.
Some sites might change to using a new CDN, which of course will use a different IP space as well.
If you're having specific issues with your HTTPS and URL blocking, depending on the equipment, you could ask in another question for assistance on those specific problems. The answers might better aid you in blocking access to these sites.
whois lookups, for the few ranges that I spot checked, do list Facebook as the assigned organization. In my experience HE's BGP Toolkit does a good job of giving accurate information.
– Brett Lykins
Sep 4 '13 at 5:03
To block an unacceptable website you would normally use a proxy server or web filtering firewall. Either by forcing everybody to use the proxy and blocking the normal access to the web or use a firewall and block the offending URL(s). Using IP addresses is never a good option for websites as these addresses can change very often for big sites (when they switch to/from CDNs, when they add another cluster that's nearer at your location, etc.).
Finding out all IP addresses a big website uses is very difficult with big players like Facebook and Google. Also there are many services who can be used as a proxy to access these sites despite you blocking the IP.
I've been using NBAR to throttle Facebook, but you can tweak it to block. This will only work on plain-text HTTP requests which effectively blocks someone entering the address in the browser before a redirect to HTTPS can take place. SSL (TLS) bookmarks to FB would be missed.
You could also look at the new ASA-X CX (Context Aware security) that should be able to handle this, though I haven't deployed this yet.
class-map match-any facebook-not4you
match protocol http host "*facebook.com"
match protocol http host "*fbcdn.net"
!
policy-map badfacebookbad
class facebook-not4you
drop
!
interface Gi0/1
service-policy output badfacebookbad
In your place, if i were in the chance to spend some moneys, I would put a UTM capable box between your gateway and your LAN.
For instance is extremely easy to put a FortiGate firewall in transparent mode ( working like a ethernet bridge ) and drop all the web requests destined to the "Social Networking" sites category.
