Skip to content

Commit 702405e

Browse files
adulauadulau
committed
Experimental BGP Ranking output added
BGP Ranking is an experimental services from CIRCL to get a rank about the number of matches against public blacklist for an ASN. The minimal value is 1 (no match) to a floating value increasing with the number of matches. The services is also displaying the number of match compared to the total public blacklist used. For more info: http://www.terena.org/activities/tf-csirt/meeting32/dulaunoy-bgpranking.pdf
1 parent a08f8ae commit 702405e

File tree

3 files changed

+47
-22
lines changed

3 files changed

+47
-22
lines changed

‎README

+7-8
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,10 @@ received.
88
## Features
99

1010
- Display abuse and contact for each hop
11+
- Display CIRCL BGP Ranking services (experimental)
1112
- Can highligh specific country to match CSIRT's constituency
1213
- Output RBL entries for each hop
13-
- Output Google Maps traceroute (e.g. http://www.foo.be/traceroute-circl/test.html )
14+
- Output Google Maps traceroute (e.g. [a sample output](http://www.foo.be/traceroute-circl/test.html) )
1415
- Show ASN origin from RIPE RIS and origin.asn.cymru.com sources
1516

1617
## Usage
@@ -21,21 +22,19 @@ received.
2122
perl traceroute-circl -i australia.gov.au -m out.js
2223
perl traceroute-circl -i www.w3c.org -o"-I -v"
2324

24-
traceroute-circl v0.2
25+
traceroute-circl v0.3
2526
usage: traceroute-circl [options]
2627
options
2728
-d, --debug Debug mode
2829
-i, --ip IP address to lookup
2930
-r, --rbl RBL domain to lookup
31+
-b, --bgpranking Output CIRCL BGP Ranking for each ASN
3032
-o, --addoptions Additional option to traceroute
3133
-c, --country Country ISO code to highlight (!!) in the output
3234
-f, --fullcountry Display full country name
3335
-m, --geomap Output file for the google map
3436
-h, --help This help message
35-
--man Display documentation
36-
37-
You must at least specify an IP address to lookup
38-
37+
--man Display documentation
3938

4039
## Dependencies
4140

@@ -51,7 +50,7 @@ received.
5150

5251
## Authors
5352

54-
Copyright (C) 2010 Alexandre Dulaunoy
53+
Copyright (C) 2010-2011 Alexandre Dulaunoy
5554

56-
Copyright (C) 2010 CIRCL Computer Incident Response Center Luxembourg (smile gie)
55+
Copyright (C) 2010-2011 CIRCL Computer Incident Response Center Luxembourg (smile gie)
5756

‎README.md

+6-7
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ received.
88
## Features
99

1010
- Display abuse and contact for each hop
11+
- Display CIRCL BGP Ranking services (experimental)
1112
- Can highligh specific country to match CSIRT's constituency
1213
- Output RBL entries for each hop
1314
- Output Google Maps traceroute (e.g. [a sample output](http://www.foo.be/traceroute-circl/test.html) )
@@ -21,21 +22,19 @@ received.
2122
perl traceroute-circl -i australia.gov.au -m out.js
2223
perl traceroute-circl -i www.w3c.org -o"-I -v"
2324

24-
traceroute-circl v0.2
25+
traceroute-circl v0.3
2526
usage: traceroute-circl [options]
2627
options
2728
-d, --debug Debug mode
2829
-i, --ip IP address to lookup
2930
-r, --rbl RBL domain to lookup
31+
-b, --bgpranking Output CIRCL BGP Ranking for each ASN
3032
-o, --addoptions Additional option to traceroute
3133
-c, --country Country ISO code to highlight (!!) in the output
3234
-f, --fullcountry Display full country name
3335
-m, --geomap Output file for the google map
3436
-h, --help This help message
35-
--man Display documentation
36-
37-
You must at least specify an IP address to lookup
38-
37+
--man Display documentation
3938

4039
## Dependencies
4140

@@ -51,7 +50,7 @@ received.
5150

5251
## Authors
5352

54-
Copyright (C) 2010 Alexandre Dulaunoy
53+
Copyright (C) 2010-2011 Alexandre Dulaunoy
5554

56-
Copyright (C) 2010 CIRCL Computer Incident Response Center Luxembourg (smile gie)
55+
Copyright (C) 2010-2011 CIRCL Computer Incident Response Center Luxembourg (smile gie)
5756

‎bin/traceroute-circl

+34-7
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
#
33
# traceroute-circl - Traceroute improved wrapper for CSIRT and CERT operators
44
#
5-
# Copyright (C) 2010 CIRCL Computer Incident Response Center Luxembourg (smile gie)
6-
# Copyright (C) 2010 Alexandre Dulaunoy
5+
# Copyright (C) 2010-2011 CIRCL Computer Incident Response Center Luxembourg (smile gie)
6+
# Copyright (C) 2010-2011 Alexandre Dulaunoy
77
#
88
# This program is free software: you can redistribute it and/or modify
99
# it under the terms of the GNU General Public License as published by
@@ -38,11 +38,12 @@ my $ris = Net::Whois::RIS->new();
3838
my $opt = new Getopt::Compact(
3939
name => 'traceroute-circl',
4040
modes => [qw(debug)],
41-
version => '0.2',
41+
version => '0.3',
4242
struct => [
43-
[ [qw(i ip)], qq(IP address to lookup), ':s' ],
44-
[ [qw(r rbl)], qq(RBL domain to lookup), ':s' ],
45-
[ [qw(o addoptions)], qq(Additional option to traceroute), ':s' ],
43+
[ [qw(i ip)], qq(IP address to lookup), ':s' ],
44+
[ [qw(r rbl)], qq(RBL domain to lookup), ':s' ],
45+
[ [qw(b bgpranking)], qq(Output CIRCL BGP Ranking for each ASN), ':s' ],
46+
[ [qw(o addoptions)], qq(Additional option to traceroute), ':s' ],
4647
[
4748
[qw(c country)],
4849
qq(Country ISO code to highlight (!!) in the output), ':s'
@@ -112,9 +113,16 @@ while (<TRACEROUTE>) {
112113
if ( !defined($ra) ) { $raok = "No A record for PTR"; }
113114
if ( $ra == $tip ) { $raok = "OK"; }
114115
if ( !defined($ptr) ) { $raok = "N/A"; }
116+
my $asn = $ris->getOrigin();
117+
my $bgpranking;
118+
119+
if ( defined( $opts->{bgpranking} ) ) {
120+
$asn =~ s/^AS//g;
121+
$bgpranking = GetBGPRanking($asn);
122+
}
115123
$r .=
116124
" ASN (RIS):"
117-
. $ris->getOrigin() . " "
125+
. $asn . " "
118126
. $ris->getDescr()
119127
. " ASN INFO:"
120128
. join( ' ', Net::Abuse::Utils::get_asn_info($tip) ) . " PTR:"
@@ -126,6 +134,10 @@ while (<TRACEROUTE>) {
126134
$r .= " RBL:"
127135
. Net::Abuse::Utils::get_dnsbl_listing( $tip, $opts->{rbl} );
128136
}
137+
138+
if ( defined( $opts->{bgpranking} ) ) {
139+
$r .= " BGP Ranking:" . $bgpranking;
140+
}
129141
}
130142

131143
if ( defined( $opts->{country} ) ) {
@@ -153,6 +165,21 @@ if ( defined( $opts->{geomap} ) ) {
153165

154166
close(TRACEROUTE);
155167

168+
sub GetBGPRanking {
169+
170+
my $asn = shift;
171+
172+
my $con =
173+
IO::Socket::INET->new( PeerAddr => "pdns.circl.lu", PeerPort => 43 )
174+
or die();
175+
print $con $asn . "\n";
176+
my $x;
177+
while (<$con>) {
178+
$x = $x . $_;
179+
}
180+
return $x;
181+
}
182+
156183
sub GetPTR {
157184
my $ip = shift;
158185
my $iip = inet_aton($ip);

0 commit comments

Comments
 (0)