8

I'm looking for the way to take an estimate consumptions toward internet per Autonomous System Number which could help me to make a decision if it's necessary to establish a peering with this AS's company or not according the consumption.

My question is: Is that possible with standard tools? How?

Improve this question
2
  • Sadly, requests for resources are off-topic here.
    – Ron Trunk
    Commented Jan 16, 2019 at 14:19
  • 2
    It's certainly possible to do this with Wireshark's > Statistics > Endpoints command but needs a little setting up. I've edited the question to ask about standard tools, and voted to reopen. I'll happily add the answer if this reopens.
    – jonathanjo
    Commented Jan 16, 2019 at 17:39

1 Answer 1

Reset to default
11

You can certainly do this with Wireshark.

In the menu choose Statistics > Endpoints and you will see a window like this: enter image description here

You might need to copy and paste into Excel to sum the bytes per AS, or use some awk/python one-liner.

If the columns marked AS Number and AS Organization are blank throughout, you need to configure the database for looking these up. It can be a little tricky to find the information but it's well described at Wireshark's documentation https://wiki.wireshark.org/HowToUseGeoIP and summarised here:

Configuration in brief:

  • Say where the MaxMind databases are going to go (Edit > Preferences > Name Resolution)
  • Download Max Mind's (free) Autonomous System database, unzip it, and put in the directory of previous step
  • Reload Wireshark

You will also be able to see the Autonomous System information on the per-packet analysis, and use it in filters and so on.

Internet Protocol Version 4, Src: 35.178.36.114, Dst: 192.168.0.19
    ...
    Source: 35.178.36.114
    Destination: 192.168.0.19
    [Source GeoIP: ASN 16509, Amazon.com, Inc.]

If you can't get Wireshark to look at the packets directly, and you have Cisco routers in a suitable place, you can use Netflow to capture the packets and export the capture from the router and import it into Wireshark for analysis.

If you have some other problem, consider finding a CSV of the address ranges of the AS numbers, and use awk/python/excel/whatever to do what you need. Search for "ip to asn mapping" and you will find many open source ones.

Improve this answer
3
  • 2
    The way I read the question, it sounds like the OP is looking for something like NetFlow.
    – Ron Maupin ♦
    Commented Jan 16, 2019 at 18:37
  • @RonMaupin you may well be right
    – jonathanjo
    Commented Jan 16, 2019 at 18:49
  • @jonathanjo thank you very much, it's perfectly what I need, I'll try that thank you all
    – Mamitiana Ra
    Commented Jan 17, 2019 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.