REX - the Resource Explainer

Robert Kisteleki — Sep 23, 2009 11:25 AM
Filed under: , , , , ,
The current version (v0.1) knows only about IPv4 address space. We went for the most difficult part first. ASNs and IPv6 address space will follow (please note the follow-up articles below describing additional functionality about the Resource Explainer).

Please also see: REX Supports IPv6 and REX Usage Report.

Our Resource Explainer, REX for short, is a one-stop-shop for almost all the information you ever wanted to know about Internet number resources. It provides you with an all-inclusive, detailed report about the resources you're interested in. It will provide you with current and historical information from a number of perspectives.  If you want to find out everything about an Internet number resource - REX is the service to try!

The current version (v0.1) knows only about IPv4 address space. We went for the most difficult part first. ASNs and IPv6 address space will follow.

If you're impatient and would like to jump to the tool immediately then go ahead, check it out now! 

 

What is REX?

REX provides you with information about different aspects of a resource:

  • Which RIR is responsible for it
  • Who is the holder of the resource
  • How it was routed on the public Internet
  • DNS and reverse DNS information
  • Network activity as seen by some Internet measurements
  • Relation to blacklists and spamlists
  • Geolocation

Whenever it makes sense, we also dive into more/less specific resources (and that's almost always the case). All of this information is provided for the current state, as well as how it changed over time.

 

What data is used for this?

In order to answer you all these questions, we're combining data from a wide set of input data sources from the RIPE NCC as well as other institutions. Of course, storing all the data needed for this, and quickly retrieving the relevant parts requires a very efficient and scalable storage mechanism - which we "luckily" happen to have: it's called INRDB, the Internet Number Resource Database.

In order to provide you with a comprehensive picture, many times we combine different data sources to come up with the appropriate explanation. 

 

Who can use the service?

Our goal is to provide this information for everyone who's interested in it. Having said that, we believe that we'll have different groups of users, interested in different key information about the resources: 

  • ISPs can use it to check out the state of resources for a couple of reasons
  • Our own IP Resource Analysts can use it to check the state of a resource before allocating it (which can come especially handy if/when resource transfers start to happen), or to assist with tracking the lifecycle of resources
  • Parties involved in a resource transfer (if/when it happens)
  • Law enforcement to easily gather information about abusers and such

In fact we are considering to make versions of the tool specific to each user group we can identify. These versions would not show different information, but arrange and present the information  in a way that is tailored to a specific use. Let us know how you use REX and how we can tailor it to your and your community's needs!

  

What's the point?

No matter which user group you belong to (if any), you yourself could make such a report about any resource. We're mostly using public databases, amended with our internal databases whenever it makes sense and causes no problems. But, it would take a lot of time, you'd have to consult many databases, some of which are pretty difficult to process and/or does not provide history. So we're in fact doing nothing that no one else could do - but man, it's useful, extensive and fast! So...

 

Check out REX now!

 

There are a number of examples in the comments section below. I you find something worth sharing using REX, please share it there.

 

Credits

Idea: René Wilhelm
Implementation: Bert Wijnen
Emile Aben
René Wilhelm
Róbert Kisteleki

6 Comments

shane
shane says:
Sep 24, 2009 03:38 PM

Of course the first thing I did was try my IPv6 prefix, which resulted in a syntax error.

 

Tsk, tsk!

 

dfk
dfk says:
Sep 25, 2009 10:05 AM

V6 is coming, also in REX

 

But V6 is not yet there, also in REX.

becha
becha says:
Jan 23, 2010 08:25 PM

Shane,

Rex does support IPv6 now (as of January 2010):
labs.ripe.net/content/rex-supports-ipv6
 
Ciao,
Vesna

dfk
dfk says:
Oct 03, 2009 02:33 PM

Let us look at the 'I' root name server in Stockholm. How was it routed this century? 

 

http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&st...

 

This is a decade of history and intiutive to read. Well, let us clean up the X-axis a bit without loosing much:

 

http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&st...

 

When you click on "Show prefix history table" you see all originating ASes and you can click thru to  today's   information in the RIPE database about these. So first this was routed by NORDUNET, then by NETNOD and then it got its own AS. Since August 2008 a /23 is also announced. Can you see the Spanish pirate? There was a short period when NETNOD announced both prefixes again. Unfortunately we cannot (yet) see here specifically which peers we saw this from.  For now we can find out a little more with the raw qery tool for "INRDB Light", but that is something for hard core users:

 

http://albatross.ripe.net/cgi-bin/inrdb-risribl.cgi?res=192.36.148.0%2F2...

 

Let's go back to 

 

http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&st...

 

Clicking on the "Resource Holder" tab is also interesting. The 'I' root name server prefix was always with "CAFAX", the covering /16 has seen two orderly transitions.

 

The "Geoloc" tab is rather boring and not quite correct.

 

Let us look a bit at the surroundings: putting  your cursor on the prefix at the top of the page will show the neighboring, the less specific and the more specific prefixes. If you click the less specific one, "Routing" will show information about 192.36.149.0/24 in addition to what has been there before. Interesting. Also look at the "Resource Holder" tab and see how intuitive the presentation of this information is. The "Responsible RIR" tab has the right info but needs an expert to read it; can you come up with suggestions to make this more useful?

 

Then go to "Routing" and one level less specific. Suddenly there appears our friend Peter ....

 

Click thru more levels of "less specific" and get a feeling how intuitive the presentation is. And it is extremely fast. Consider the amount of raw data making up these graphs!

 

Are we still in Sweden? Click on geoloc to find out!

 

More less specifics. When are we leaving Sweden?

 

 


 

 

The www.google.com prefix is also interesting:

 

http://albatross.ripe.net/cgi-bin/rex.pl?res=+209.85.226.0%2F23&type=all...

 

It was routed by someone else a long time ago and it got a longer prefix announced sometime, guess when? 

 

 


 

 

Here is a very Dutch ISP:

 

http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=194.109.0.0/16&sti...

 

 The DNS tab is also intersting there. Routing has been colorful in the past.

 

 


 

 

Let us look at another interesting neighborhood outside the RIPE region:

 

http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=216.34.176.0/20&st...

 

Expand the domains by clicking on the + s in the table. By combining pulic data from various sources REX is also useful for resources which are not in the RIPE database. Do you have suggestions for information that should be in REX?

 

 


 

 

Can you find interesting and useful things too? Share them here!

 

 

Shpatz O.
Shpatz O. says:
Aug 03, 2010 10:07 AM
Is it possible to add a feature for domain names as well?
It could be nice to obtain historical DNS records for domains. There are some similar services on the web but their coverage is poor.
kistel
kistel says:
Sep 03, 2010 10:22 AM
It would be possible, provided that we have a reliable source of historical information on this. Keep in mind though that the seervice focuses on number resorces, so what I could imagine here is a list of domains that somehow used the queried IP addresses.
Add comment

You can add a comment by filling out the form below. Only plain text is possible. Web and email addresses will be transformed into clickable links. Comments are moderated so they won't appear immediately.

Related Items
Increased Reach of RIPE Atlas Anchors

Increasing the reach of RIPE Atlas anchors is one of the highest priority goals of RIPE Atlas Team. ...

Proposing Making RIPE Atlas Data More Public

RIPE Atlas is now three years old, and is moving from a prototype to production service. Based on ...

Modifications to the IP Analyser to Reflect New Policy

We are in the process of implementing the policy regarding Post Depletion Adjustment of Procedures ...

Report on IPv6 Security Test Methodology

The Dutch Institute for Applied Scientific Research (TNO) and a number of Dutch security companies ...

RIPE Atlas: Improved Probe Pages

We've made it much easier to get an overview of the history and measurements for all the public ...

more ...