0

AWS publishes ip-ranges.json, and when a client connects to my system I can search the JSON file to determine if the client is coming from AWS or not.

If I don't need to know the AWS region, I could also use Team Cymru to map the client IP to the Autonomous System and name:

$ dig +short 88.99.235.34.origin.asn.cymru.com TXT
"14618 | 34.224.0.0/12 | US | arin | 2016-09-12"

$ dig +short AS14618.asn.cymru.com TXT
"14618 | US | arin | 2005-11-04 | AMAZON-AES, US"

AWS also offers a Bring Your Own IP (BYOIP) product (docs). IPs provided by the customer don't appear in ip-ranges.json, and mapping to an Autonomous System (AS) shows the customer AS rather than Amazon.

Is there any practical way for me to identify a client IP as being AWS hosted via BYOIP?

Maybe the answer is "examine BGP peering records"? If so, that's somewhat involved right?

Improve this question

2 Answers 2

Reset to default
1

AWS BYOIP documentation says that your prefix will be announced by Amazon ASNs 16509 and 14618

So, check the originating ASN of the prefix

$ dig +short 0.0.33.13.origin.asn.cymru.com TXT
"16509 | 13.33.0.0/24 | US | arin | 2020-08-05"

If the ASN is 16509 or 14618 and the IP is not in ip-ranges.json, it can be a BYOIP. but keep in mind that everything from AS16509 is not always a BYOIP prefix (it can be Amazon owned stuff)

from my observation, as of today, BYOIP are always originated from AS16509

you can look here for examples of some BYOIP prefixes: https://bgp.he.net/AS16509#_prefixes

Improve this answer
1

Following the directions provided by AWS indicates that the customer should stop advertising the selected IP network (/24 or larger) before configuring it to be advertised by AWS (and after their other setup and security procedures) which indicates the selected IP network would be advertised as being reachable only via the normal AWS AS numbers.

I would assume that means you can make the determination via the normal method of examining the ASN which originates the IP addresses in question.

Improve this answer
5
  • That would be "look at BGP". Who owns the address space, and who announces are different things, reflected in different databases.
    – Ricky
    May 15 at 19:45
  • @Ricky The original poster is using a DNS lookup via Cymru to discover the ASN for a desired IP network without having to query BGP or other routing tools. The Cymru service allows a DNS query to obtain reasonably recent BGP sourced ASN source information. team-cymru.com/ip-asn-mapping
    – FrameHowitzer
    May 15 at 23:10
  • Oh interesting, so you think that I should expect to see the customer owned IP prefixes advertised in BGP with AWS as the origin ASN rather than the customer owned ASN as the origin?
    – James Healy
    May 16 at 11:39
  • I was assuming (wrongly?) that I'd see the customer ASN as the origin ASN, and AWS would potentially be on the AS path
    – James Healy
    May 16 at 11:40
  • Yes @JamesHealy. The instructions from AWS indicate the selected IP address network should no longer be advertised on the owner organization's ASN. It should only be advertised by AWS. So you should see it only reachable via AWS, just like all AWS owned IP addresses.
    – FrameHowitzer
    May 16 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.