4

How would I go about mapping a prefix to an organization? I know I can use whois to map a given IP address to its AS and organization, but what about a prefix (as in, IP and some netmask)?

Lets say provider A owns the prefix 192.1.0.0/16 and sells 192.1.0.0/24 to company B. Now if I lookup the IP 192.1.0.x I will get company B. But what If I specifically want to find out who owns 192.1.0.0/16? So far all the services I've found only map IP's to organizations, but not prefixes. Is there any way to get this information?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 6, 2021 at 2:45

2 Answers 2

Reset to default
3

Every whois service provides different option to specify which information you want. I have most experience with the RIPE database. There is a web interface available, but the most direct way to access the information is using the command line. You can request help using this command:

$ whois -h whois.ripe.net -- -h

There you can see the option that you need:

%     -L, --all-less <ip-lookup>
%           Returns all level less specific inetnum, inet6num or route(6)
%           objects, including exact matches.

If I request information about my own address (yes, I am my own ISP):

$ whois -h whois.ripe.net -- '--all-less 37.77.56.75'
[...]
inetnum:        0.0.0.0 - 255.255.255.255
netname:        IANA-BLK
descr:          The whole IPv4 address space
[...]
inetnum:        37.0.0.0 - 37.255.255.255
netname:        EU-ZZ-37
descr:          RIPE NCC
descr:          European Regional Registry
[...]
inetnum:        37.77.56.0 - 37.77.63.255
netname:        NL-STEFFANN-20120201
descr:          S.J.M. Steffann
[...]
inetnum:        37.77.56.64 - 37.77.56.127
netname:        STEFFANN-OFFICE1
descr:          S.J.M. Steffann Office
[...]

And you can see the whole hierarchy. The web interface shows exactly the same information.

Improve this answer
2

You can check your RIR's whois database. For example, if you go to www.Arin.net and enter an IP to search in their who-is, the record should provide a link to the parent.

Have a look here for more info: https://www.arin.net/resources/whoisrws/index.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.