Sometimes you really want to know where an IP is coming from. Whether you are doing abuse or threat hunts, or just want to know who owns that IP blocked by fail2ban for spamming your SSH server. Each IP belongs to a specifc Autonomous System. An autonomous system (AS) is a very large network or group of networks with a single routing policy. Each AS is assigned a unique ASN, which is a number that identifies the AS.
iptoasn.com used to provide a free webservice to perform IP address to ASN resolution but they have discontinued it for many good reasons. However, their IP to ASN (and Country) mapping database is still free and updated hourly. So I decided to write a command-line app to fetch (and locally cache) their database and perform IP to ASN resolution. Here’s an example:
$> ip2asn 8.8.8.8 1.1.1.1 9.9.9.9 2.2.2.2
┌─────────┬───────┬───────────────┬─────────┬─────────────┬───────────┐
│ IP │ ASN │ DESCRIPTION │ COUNTRY │ RANGE START │ RANGE END │
├─────────┼───────┼───────────────┼─────────┼─────────────┼───────────┤
│ 8.8.8.8 │ 15169 │ GOOGLE │ US │ 8.8.8.0 │ 8.8.8.255 │
│ 1.1.1.1 │ 13335 │ CLOUDFLARENET │ US │ 1.1.1.0 │ 1.1.1.255 │
│ 9.9.9.9 │ 19281 │ QUAD9-AS-1 │ US │ 9.9.9.0 │ 9.9.9.255 │
│ 2.2.2.2 │ │ │ │ │ │
└─────────┴───────┴───────────────┴─────────┴─────────────┴───────────┘
EDIT: I added optional IP geolocation using a database from IP2Location LITE if you provide the app with your download token from your free account.
Hope you find it useful.