Wireshark · Ethereal-dev: [ethereal-dev] as-lookup

["Hannes R. Boehm" <hannes@xxxxxxxxx>]

Hi fellow developers,

What do you think about AS number lookup ???

take a short look at the example Autonomous System Number lookup routines
I wrote....
(this doesn't support RPSL (yet :) - but it works with RIPE-181)

what is missing: 
hash tables for speedup (like in the DNS code)
better error checking
[...]


We could use it in the IP header display:

SRC IP host.domain.name (x.x.x.x) (SRC AS: xxxx)
DST IP host.domain.name (x.x.x.x) (DST AS: xxxx)
                                      ^^^ 
(or everywhere we encounter IP addresses)

CU,

Hannes

PS: I don't have enough time to fully implement this feature myself now
    -> If someone else wants to do it -> just mail me 


-- 
--
"The nice thing about standards is that there's so many to choose from." 
        -- Andrew S. Tanenbaum
!------------------------------------------------------------------!
  Hannes R. Boehm
        email   : hannes@xxxxxxxxx
        www     : http://hannes.boehm.org
        PGP-key : http://hannes.boehm.org/hannes-pgp.asc
!------------------------------------------------------------------!

#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>

#define WHOIS_PORT	43

int get_as_by_ip(int ip){
	struct sockaddr_in	whois_server;
	int					whois;
	FILE				*whoisfo;
	FILE				*whoisfi;
	int					autnum;
	int					found;
	char				strg[250];
		
	bzero(&whois_server, sizeof(whois_server));
	whois_server.sin_family=AF_INET;
	whois_server.sin_port=htons(WHOIS_PORT);

	/* whois.ripe.net */
	whois_server.sin_addr.s_addr=inet_addr("193.0.0.200");

	/* whois.ra.net  ??? doesn't work with the -T argument */
	/* whois_server.sin_addr.s_addr=inet_addr("198.108.0.11"); */

	/* error handling */
	whois = socket(AF_INET, SOCK_STREAM, 0);
	if(connect(whois, &whois_server, sizeof(whois_server) ) == -1 ){
		printf("error connect\n");
		return 0;
	}

	whoisfo = fdopen(whois, "w");
	whoisfi = fdopen(whois, "r");

	fprintf(whoisfo, "-a -r -T route %s\n", inet_ntoa(ip) );
	fflush(whoisfo);


	found=0;
	bzero(strg, 100);
	while( (fscanf(whoisfi, "%s", strg)) != EOF ){
		if(strg[0] == 0)
			continue;
		if(strncmp(strg, "origin:", 7) == 0 ){
			found=1;
			break;
		}
	}

    if(!found || fscanf(whoisfi, "%s", strg) == EOF){
		return 0;
	}

	fclose(whoisfo);
	fclose(whoisfi);
	close(whois);

	/* remove the "AS" part if possible */

	if(strncmp(strg, "AS", 2) != 0) 
		return 0;

	/* if the origin string starts with AS we can remove it now */
	memset(strg, ' ', 2);

	/* okay: now convert to integer */

	sscanf(strg, "%u", &autnum);

	return autnum;
}

main(){
	printf("ip:%s as:%d\n", inet_ntoa(htonl(0xc01f0782)), get_as_by_ip(htonl(0xc01f0782)) );
	printf("ip:%s as:%d\n", inet_ntoa(htonl(0xd41f4001)), get_as_by_ip(htonl(0xd41f4001)) );
	printf("ip:%s as:%d\n", inet_ntoa(htonl(0x87910986)), get_as_by_ip(htonl(0x87910986)) );
}