When using traceroute -A, where does the ASN come from

bgpcommand-line-interfacedomain-name-systemnetworking

I haven't cracked open the source code yet, but I was curious which whois service the traceroute program uses to look up ASNs for a given IP.

Best Answer

The copy running on my Linux box gets its answers from 198.108.0.18. I was able to tell this by running tcpdump at the same time as running a traceroute.

The PTR records for that IP resolve to rpsl-p.merit.edu, and it happens that whois.radb.net. and whois.ra.net. point to the same IP address.

Further examination of the binary (with "strings") reveals that it's actually using the whois.radb.net hostname. There's also a pair of (undocumented) environment variables ($RA_SERVER and $RA_SERVICE) which can change the host and port used for these queries.

Related Topic