2

How can we find the as-set of asn?

For Example I have the asn:32934. I want the as-set?

| improve this question | |
  • 1
    Hi Drik, welcome to NESE. This question and resulting answer might provide some context as to what the AS-SET, and potentially allow you to answer your own question. – Eddie Oct 1 '18 at 23:15
2

As I understand it, you're looking for a way to determine the set of ASNs advertised by a BGP peer, and as a result the total set of prefixes advertised by this peer, both originated from the peer ASN and its downstreams.

As far as I'm aware, there is no single source of truth for querying which BGP is peer advertising which AS-set. Three sources come to mind:

  1. peeringDB. A lot of networks do register this information there, but there is not that much checking, so anyone can claim to advertise any set. Thanks to the peeringDB API querying this information is easy.

  2. routing registry information (whois data) for the peer ASN. This may contain some information, mostly in freeform text as remarks, about AS-SET the peer advertises. Just as peeringDB, not really reliable since there's no verification, and harder to parse because output is not standardised.

  3. RPSL data in routing registries. If a peer registered its routing policies in RPSL format, you may be able to determine their policy for your peering session based on what they're advertising to other peers. RPSL data is in a standardised format so it's easier to parse, but again there's no verification and also you can't be sure you can deduce the policy from other policies.

Bottomline: it's hard to get reliable data and this is hard to automate building prefix lists to filter incorrect advertisements (I guess that's your ultimate goal here?). So what can help you here?

  1. when establishing a new peering relationship, ask the peer for their AS-set. Especially since an ASN can advertise different AS-sets on different locations, just an peer AS to AS-set mapping is not enough.
  2. when working with unreliable data, consider implementing RPKI validation as an extra check to determine if the received route is valid.
| improve this answer | |
1

If you have linux host, make sure bind-utils tools are installed (whois should work).

For the AS "32934" do the following: whois -h whois.radb.net AS32934 | grep mnt --> Grabs all the maintainer objects for this AS.

For each MNT object, run the whois command again. whois -h whois.radb.net !o'$MNT' | grep as-set --> This should give the list of all the AS-SETs this AS is part of. Checking for AS32934.... It seems it belongs to Facebook AS-SET.

*****Edited***

| improve this answer | |
  • 2
    That may work in some cases, but in many it won't. First, many networks don't register in radb, there are many more (and better) registries. Second, maintainership and AS-sets are not in any way linked in the whois databases. The AS does not have to use the same maintainers as the AS-SET. It can work in some specific cases as you described, but in many cases this will give you no or incorrect information. – Teun Vink♦ Nov 18 '19 at 5:58
  • 1
    RADB will pull info from other IRRs as well. You can check the "source" of the entry at the bottom of the output (showing RADB,ARIN,RIPE etc). Secondary, you can verify that output by comparing the results on "irrexplorer.nlnog.net" which shows history and all records related to that particular AS. It even shows the discrepancy among various records that exist for one AS. – Shaunak Kakade Nov 19 '19 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.