Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses?
Using Facebook as an example... We police their bandwidth to a small fraction of our total directly on our ASA (because another group in the company owns the web-proxy).
I normally lookup the ASN of the company (Facebook is 32934), then I go to http://as.robtex.com/as32934.html#bgp
and find their prefixes.
From that list, I build a Cisco ASA object group, which I can use to classify traffic... This is what I'm using now... Facebook gets throttled to a small amount of bandwidth... It works very well.
Every so often, you'll have to go back and check robtex AS-info to see whether they have added or removed prefixes. I usually try to take the largest aggregate block they have, even if they are only announcing smaller blocks from that larger aggregate.
object-group AS32934_Facebook
network-object 31.13.24.0 255.255.248.0
network-object 31.13.64.0 255.255.192.0
network-object 66.220.144.0 255.255.240.0
network-object 69.63.176.0 255.255.240.0
network-object 69.171.224.0 255.255.224.0
network-object 74.119.76.0 255.255.252.0
network-object 103.4.96.0 255.255.252.0
network-object 173.252.64.0 255.255.192.0
network-object 204.15.20.0 255.255.252.0
The python code I use to generate the list is trivial...
from ipaddr import IPv4Network, CollapseAddrList
fb_nets = list()
with open('facebook_nets.txt') as fh:
for line in fh:
net = IPv4Network(line.strip())
fb_nets.append(net)
print "object-group AS32934_Facebook"
for net in sorted(CollapseAddrList(fb_nets)):
print " network-object %s %s" % (net.network, net.netmask)
The code assumes you put all their prefixes in a text file called "facebook_nets.txt", with one prefix per line...
(py26_dfl)[mpenning@Bucksnort ~]$ head facebook_nets.txt
31.13.24.0/21
31.13.64.0/18
31.13.64.0/19
31.13.64.0/24
31.13.65.0/24
31.13.66.0/24
31.13.67.0/24
31.13.68.0/24
31.13.69.0/24
31.13.70.0/24
(py26_dfl)[mpenning@Bucksnort ~]$
Actually my script automatically web-scrapes the info every week, but this is a simplified version.