2

I've noticed that various services for this IP 85.222.136.21 returns different AS numbers.

For example, http://bgp.he.net/ip/85.222.136.21#_ipinfo says AS14340, while on the Whois section, there it says AS15982. Why is that?

I've also asked my friend from different continent to run a traceroute with AS number resolution and he got AS14340, while on my machine it resolve to AS15982.

Dzh
  • 195
  • 1
  • 7

2 Answers2

2

There is nothing to force routing information in whois to match up with what is actually in the routing tables.

Also there is nothing in BGP that prevents a single prefix being originated from more than one AS.

In this case I would guess that at some point the originating AS for the prefix was changed but noone got arround to updating the routing information in whois.

Peter Green
  • 4,056
  • 10
  • 29
2

As you've discovered, there are different ways to determine what ASN an IP address is associated with. In general, you can look in three places:

  1. Real-time (or historic) BGP (global routing) data

  2. Routing Registry records

  3. IP allocation / assignment records

Also, to add confusion, there can be several origin ASNs in #1 and overlapping records in #2. It's possible to overlapping in #3, but less likely as long as you stick to the most specific.

The difference in results you are experiencing is a combination of:

  • where you (or your tool is) looking things up

  • if there is overlap ...and if so, what your tool does to decide which one to display

Where to look?

Depends. The most accurate of what's live in the wild is BGP itself (#1). Just keep in mind it can change. The first link you provided is based on a snapshot from BGP. You can use a looking glass for real-time information from a particular network's perspective.

Josh Richards
  • 161
  • 3
  • Interesting. Wondering where does `traceroute` queries to get the ASN? I see you can specify custom server to use, but `man` doesn't specify what is default source. – Dzh Aug 31 '16 at 21:47
  • It depends on the traceroute implementation. The one included in a lot of Linux distributions appears to use whois.radb.net. That means it relies on method #2. In your example that would return AS15982 probably. What traceroute implementation did your friend use? – Josh Richards Aug 31 '16 at 23:49
  • Both on OS X, though he's behind one release. – Dzh Sep 01 '16 at 03:34