asn is a Bash-based OSINT lookup tool that aggregates ASN data, RPKI validity, BGP statistics, IP reputation and geolocation for incident response and authorized network investigations.
| Tool | nitefood/asn — ASN/RPKI/BGP/IP reputation lookup tool and web traceroute server written in Bash |
| Category | Network OSINT and reconnaissance CLI, MIT licensed, ~1.9k stars |
| Primary Use | Fast enrichment of IPs, prefixes and ASNs during incident-response triage, log analysis and authorized recon via services like Team Cymru, RIPEStat, Shodan and GreyNoise |
| Safe Use | Intended for authorized professionals: analysts investigating their own or customers' networks, blue teams triaging logs, and researchers doing passive OSINT — it queries third-party data sources rather than touching targets |
| Telemetry Note | Purely query-based: it sends no packets to targets (except optional mtr traces) but every lookup is visible to the ~20 data providers it calls (RIPEStat, Shodan, GreyNoise), so usage is observable server-side at those APIs |
nitefood/asn occupies a niche that larger frameworks tend to over-engineer: a single Bash script, requiring Bash v4.2+, that answers the question "what is this IP, prefix or autonomous system?" in seconds. Rather than implementing its own data collection, it acts as an aggregation layer over roughly twenty public and commercial intelligence services — Team Cymru for IP-to-ASN mapping, RIPEStat for RPKI validation, PeeringDB and CAIDA ASRank for peering topology, Shodan for fingerprinting, and reputation feeds like GreyNoise, StopForumSpam and ISC DSHIELD. The result is a one-command replacement for a dozen browser tabs during an investigation. The project is MIT licensed, written almost entirely in Shell, and carries close to two thousand stars, which for a script with no binary dependencies is a strong signal of real operational adoption.
The core lookup path is deceptively rich. Given an IP address, asn returns the originating autonomous system, its announced prefix, organization name and RIR region, plus classification of the IP itself — anycast, mobile, proxy, ISP, government, education, datacenter or IXP prefix. Broad typing comes from ip-api, while finer datacenter and region attribution is pulled from Ipapi.is. Bogon addresses traversed during traces are classified against the relevant RFC — private space, CGN, link-local, reserved — which is a detail incident responders will appreciate when parsing logs full of internal noise. Abuse contact discovery for any IP or prefix rounds out the enrichment, useful when the next step is a notification rather than further analysis.
Where the tool earns its keep for network-level work is the AS-centric feature set. For any AS number it reports IXP presence, a global AS rank derived from customer cone size and peering counts, BGP statistics such as neighbor and originated v4/v6 prefix counts, and — notably — BGP incident history covering hijacks and route leaks over the past twelve months, from both the victim and hijacker perspective. Peering relationships are broken down by upstream, downstream and uncertain, sorted by observed path count so the first few upstreams are likely actual transits; a recap of transits, peers and customers per latest CAIDA data is included. Announced prefixes are aggregated up to the most relevant less-specific INET(6)NUM object, mapping announcements back to actual LIR allocations rather than raw routing table entries.
The RPKI story is particularly well thought out. Every IP gets an RPKI validity check through the RIPEStat validation API, and during path traces the tool matches each hop's ASN/prefix pair — retrieved from the Prefix Whois public server — against published ROAs. On origin AS mismatch or an unallowed more-specific announcement, it flags a potential route leak or BGP hijack and identifies the offending AS in the path (this requires the -d detailed-trace option). This turns what is normally a manual, multi-portal correlation exercise into a single annotated trace, and it is exactly the workflow defenders need when validating whether observed routing anomalies are attacks or misconfigurations.
The trace itself is built on mtr, with AS data extracted hop by hop. Detailed mode attaches per-hop metadata: RPKI ROA validity, organization and network name, geolocation, and Shodan-derived fingerprinting including known vulnerabilities, open ports, and OS/hardware hints via Shodan's InternetDB API. Internet exchange points traversed by the trace are detected and highlighted, which makes eyeballing where traffic crosses peering fabric trivially easy. For anyone teaching or learning inter-domain routing behavior, this output alone justifies keeping the tool installed.
asn also functions as a passive recon instrument through its Shodan scanning mode. Because it queries Shodan's historical dataset for CIDR blocks, URLs, hostnames or single IPs, it produces a breakdown of exposed ports, known CVEs and running software without sending a single packet toward the target — the README is explicit about this. Multiple simultaneous targets and IP list file inputs are supported, with JSON output. That passive property is what makes the mode defensible: you are reading a third-party's cached view of internet surface area, not probing anything yourself, which fits comfortably within authorized assessment scoping.
Geolocation supports bulk mode aimed squarely at incident response — feed it the foreign IPs from a log file and get coordinated results rather than one-off queries. The script can also map all IPv4/IPv6 CIDR blocks allocated to a given country by pulling IPdeny's ipblocks data, which is maintained directly from RIR allocations. Organization-name search returns related network ranges (with a multiple-choice menu on ambiguous matches), and ASN-name search maps an organization's ASNs, enriched with AS rank and tags highlighting the highest-ranking results. A transit-identification feature infers upstream networks for a prefix from observed BGP updates and ASPATHs, flagging tier-1 or multihomed origins.
Deployment flexibility is better than most CLI tools. The README documents container execution via Docker and Google Cloud, and the packaging status badge points to Repology, indicating availability across an unusually broad set of distributions — Debian, Ubuntu, Kali, CentOS, Red Hat, Rocky, Fedora, Arch, Manjaro, Alpine, openSUSE, FreeBSD, Nix, plus macOS, Windows under WSL2/Cygwin, and Raspberry Pi. For most users installation is a package-manager operation rather than a git clone. Optional API tokens for services like Shodan unlock the fuller feature set.
Beyond the CLI, asn runs as a web-based traceroute and lookup server: launch it in listening mode and query it from a local or remote browser via a bookmarklet or custom search engine, or from the terminal with curl or elinks. Server mode also hyperlinks results out to HE.net, BGPTools, ipinfo.io, Host.io and Cloudflare Radar for drill-down. Crucially, the same engine can expose itself as a self-hosted lookup API endpoint emitting JSON in both interactive and server mode, which makes it trivially integrable into SOAR pipelines or enrichment playbooks.
From a defensive standpoint the telemetry profile is worth understanding. The tool is loud in one specific place: every query is visible to the upstream data providers. Your lookups against Shodan, GreyNoise, RIPEStat and the rest are logged on their side, so operational security considerations around query sensitivity apply even though nothing touches the target. Reputation and noise classification — including threat scoring aimed at investigating foreign IPs in log files — means blue teams get triage hints inline, and honeypot identification from Shodan data helps filter out sinkhole noise from genuine adversary infrastructure.
Caveats are the usual ones for aggregation tools: output quality is bounded by each provider's freshness, geolocation is inherently approximate, and some enrichments (IP Quality Score, ffraud.com) key off commercial feeds with their own biases. The dependency surface is also wide — a timeout or rate limit on any of the ~20 services degrades the corresponding section of the report. None of this diminishes the core value: for authorized investigations, lab work and defensive research, asn compresses an entire OSINT workflow into one command with sane defaults, and its longevity and packaging footprint suggest it will remain a standard fixture in analyst environments for some time.
nitefood/asn.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.