Michael C. Toren on 13 Oct 2006 02:43:01 -0000


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] cname lookups


On Thu, Oct 12, 2006 at 08:28:50PM -0400, Toby DiPasquale wrote:
> UPenn owns 5 /16's. I don't know what they all are, but I know they own
> 5 of them.

It's easy enough to determine by peeking at the BGP announcements.
First, find a single IP address the network in question is announcing,
for example by querying DNS for the IP address of a primary MX:

    [mct@ellesmere ~]$ mx upenn.edu
    upenn.edu mail is handled by 0 nisc.net.isc.upenn.edu.

    [mct@ellesmere ~]$ host nisc.net.isc.upenn.edu.
    nisc.net.isc.upenn.edu has address 128.91.2.210

Next, determine which ASN is announcing a BGP route covering that address,
by logging into a public route server:

    route-server.savvis.net>sh ip bgp 128.91.2.210
    BGP routing table entry for 128.91.0.0/16, version 136280
    Paths: (1 available, best #1)
      Not advertised to any peer
      209 55, (aggregated by 55 192.84.2.254)
        208.172.146.30 from 208.172.146.30 (208.174.15.163)
          Origin IGP, localpref 100, valid, internal
          Originator: 208.174.15.163, Cluster list: 208.172.146.29

The fifth line of the above indicates that this IP address is announced by
AS55, and whois confirms that this ASN is registered to upenn.edu.  Now,
it's as simple as searching for routes which are announced by that ASN:

    route-server.savvis.net>sh ip bgp regex _55$
    [...]
       Network          Next Hop            Metric LocPrf Weight Path
    *>i128.91.0.0       208.172.146.30                100      0 209 55 i
    *>i130.91.0.0       208.172.146.30                100      0 209 55 i
    *>i158.130.0.0/17   208.172.146.30                100      0 209 55 i
    *>i158.130.128.0/17 208.172.146.30                100      0 209 55 i
    *>i165.123.0.0      208.172.146.30                100      0 209 55 i
    *>i192.84.2.0       208.172.146.30                100      0 209 55 i

So, as of the time of this writing they're announcing four /16s and
one /24.

> I'll bet other schools have some, too (e.g. MIT, Stanford, etc).

MIT was fortunate enough to have legacy Class A space, 18/8 :-)

-mct
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug