Sometimes you really want to know where an IP is coming from. Whether you are doing abuse or threat hunts, or just want to know who owns that IP blocked by fail2ban for spamming your SSH server. Each IP belongs to a specifc Autonomous System. An autonomous system (AS) is a very large network or group of networks with a single routing policy. Each AS is assigned a unique ASN, which is a number that identifies the AS.
iptoasn.com used to provide a free webservice to perform IP address to ASN resolution but they have discontinued it for many good reasons. However, their IP to ASN (and Country) mapping database is still free and updated hourly. So I decided to write a little command-line script to fetch (and locally cache) their database and perform IP to ASN resolution. Just because I can, I wrote two variants: a golang CLI app and a python script. Here’s an example:
$> ip2asn 8.8.8.8 1.1.1.1 9.9.9.9 2.2.2.2
┌─────────┬───────┬───────────────┬─────────┬─────────────┬───────────┐
│ IP │ ASN │ DESCRIPTION │ COUNTRY │ RANGE START │ RANGE END │
├─────────┼───────┼───────────────┼─────────┼─────────────┼───────────┤
│ 8.8.8.8 │ 15169 │ GOOGLE │ US │ 8.8.8.0 │ 8.8.8.255 │
│ 1.1.1.1 │ 13335 │ CLOUDFLARENET │ US │ 1.1.1.0 │ 1.1.1.255 │
│ 9.9.9.9 │ 19281 │ QUAD9-AS-1 │ US │ 9.9.9.0 │ 9.9.9.255 │
│ 2.2.2.2 │ │ │ │ │ │
└─────────┴───────┴───────────────┴─────────┴─────────────┴───────────┘
Hope you find them useful.