The current version (v0.1) knows only about IPv4 address space. We went for the most difficult part first. ASNs and IPv6 address space will follow (please note the follow-up articles below describing additional functionality about the Resource Explainer).
Our Resource Explainer, REX for short, is a one-stop-shop for almost all the information you ever wanted to know about Internet number resources. It provides you with an all-inclusive, detailed report about the resources you're interested in. It will provide you with current and historical information from a number of perspectives. If you want to find out everything about an Internet number resource - REX is the service to try!
The current version (v0.1) knows only about IPv4 address space. We went for the most difficult part first. ASNs and IPv6 address space will follow.
If you're impatient and would like to jump to the tool immediately then go ahead, check it out now!
What is REX?
REX provides you with information about different aspects of a resource:
- Which RIR is responsible for it
- Who is the holder of the resource
- How it was routed on the public Internet
- DNS and reverse DNS information
- Network activity as seen by some Internet measurements
- Relation to blacklists and spamlists
- Geolocation
Whenever it makes sense, we also dive into more/less specific resources (and that's almost always the case). All of this information is provided for the current state, as well as how it changed over time.
What data is used for this?
In order to answer you all these questions, we're combining data from a wide set of input data sources from the RIPE NCC as well as other institutions. Of course, storing all the data needed for this, and quickly retrieving the relevant parts requires a very efficient and scalable storage mechanism - which we "luckily" happen to have: it's called INRDB, the Internet Number Resource Database.
In order to provide you with a comprehensive picture, many times we combine different data sources to come up with the appropriate explanation.
Who can use the service?
Our goal is to provide this information for everyone who's interested in it. Having said that, we believe that we'll have different groups of users, interested in different key information about the resources:
- ISPs can use it to check out the state of resources for a couple of reasons
- Our own IP Resource Analysts can use it to check the state of a resource before allocating it (which can come especially handy if/when resource transfers start to happen), or to assist with tracking the lifecycle of resources
- Parties involved in a resource transfer (if/when it happens)
- Law enforcement to easily gather information about abusers and such
In fact we are considering to make versions of the tool specific to each user group we can identify. These versions would not show different information, but arrange and present the information in a way that is tailored to a specific use. Let us know how you use REX and how we can tailor it to your and your community's needs!
What's the point?
No matter which user group you belong to (if any), you yourself could make such a report about any resource. We're mostly using public databases, amended with our internal databases whenever it makes sense and causes no problems. But, it would take a lot of time, you'd have to consult many databases, some of which are pretty difficult to process and/or does not provide history. So we're in fact doing nothing that no one else could do - but man, it's useful, extensive and fast! So...
There are a number of examples in the comments section below. I you find something worth sharing using REX, please share it there.
Credits
| Idea: | René Wilhelm |
| Implementation: | Bert Wijnen Emile Aben René Wilhelm Róbert Kisteleki |
Comments 6
Comments are disabled on articles published more than a year ago. If you'd like to inform us of any issues, please reach out to us via the contact form here.
Anonymous •
<div class="content legacycomment"> <p> Of course the first thing I did was try my IPv6 prefix, which resulted in a syntax error. </p> <p> </p> <p> Tsk, tsk! </p> <p> </p> <p> </p> </div>
Hide replies
Anonymous •
<div class="content legacycomment"> <p> V6 is coming, also in REX </p> <p> </p> <p> But V6 is not yet there, also in REX. </p> </div>
Anonymous •
<div class="content legacycomment"> <p> </p> <p> Shane, </p> <p> Rex does support IPv6 now (as of January 2010): <br /> labs.ripe.net/content/rex-supports-ipv6 <br /> <br /> Ciao, <br /> Vesna </p> </div>
Anonymous •
<div class="content legacycomment"> <p> Let us look at the 'I' root name server in Stockholm. How was it routed this century? </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&stime=1999-10-02&etime=2009-10-02&page=routing&cf=1&af=1" title="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&stime=1999-10-02&etime=2009-10-02&page=routing&cf=1&af=1"> http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&st... </a> </p> <p> </p> <p> This is a decade of history and intiutive to read. Well, let us clean up the X-axis a bit without loosing much: </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&stime=2000-10-02&etime=2009-10-02&page=routing&cf=1&af=1" title="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&stime=2000-10-02&etime=2009-10-02&page=routing&cf=1&af=1"> http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&st... </a> </p> <p> </p> <p> When you click on "Show prefix history table" you see all originating ASes and you can click thru to <em> <strong> today's </strong> </em> information in the RIPE database about these. So first this was routed by NORDUNET, then by NETNOD and then it got its own AS. Since August 2008 a /23 is also announced. Can you see the Spanish pirate? There was a short period when NETNOD announced both prefixes again. Unfortunately we cannot (yet) see here specifically which peers we saw this from. For now we can find out a little more with the raw qery tool for "INRDB Light", but that is something for hard core users: </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/inrdb-risribl.cgi?res=192.36.148.0%2F23&rrc=aggr&match=x " title="http://albatross.ripe.net/cgi-bin/inrdb-risribl.cgi?res=192.36.148.0%2F23&rrc=aggr&match=x "> http://albatross.ripe.net/cgi-bin/inrdb-risribl.cgi?res=192.36.148.0%2F2... </a> </p> <p> </p> <p> Let's go back to </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&stime=2000-10-02&etime=2009-10-02&page=routing&cf=1&af=1" title="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&stime=2000-10-02&etime=2009-10-02&page=routing&cf=1&af=1"> http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=192.36.148.0/24&st... </a> </p> <p> </p> <p> Clicking on the "Resource Holder" tab is also interesting. The 'I' root name server prefix was always with "CAFAX", the covering /16 has seen two orderly transitions. </p> <p> </p> <p> The "Geoloc" tab is rather boring and not quite correct. </p> <p> </p> <p> Let us look a bit at the surroundings: putting your cursor on the prefix at the top of the page will show the neighboring, the less specific and the more specific prefixes. If you click the less specific one, "Routing" will show information about 192.36.149.0/24 in addition to what has been there before. Interesting. Also look at the "Resource Holder" tab and see how intuitive the presentation of this information is. The "Responsible RIR" tab has the right info but needs an expert to read it; can you come up with suggestions to make this more useful? </p> <p> </p> <p> Then go to "Routing" and one level less specific. Suddenly there appears our friend Peter .... </p> <p> </p> <p> Click thru more levels of "less specific" and get a feeling how intuitive the presentation is. And it is extremely fast. Consider the amount of raw data making up these graphs! </p> <p> </p> <p> Are we still in Sweden? Click on geoloc to find out! </p> <p> </p> <p> More less specifics. When are we leaving Sweden? </p> <p> </p> <p> </p> <hr /> <p> </p> <p> </p> <p> The <a href="http://www.google.com" title="www.google.com"> www.google.com </a> prefix is also interesting: </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/rex.pl?res=+209.85.226.0%2F23&type=all&stime=2000-10-02&etime=2009-10-02&cf=1&af=1&page=routing" title="http://albatross.ripe.net/cgi-bin/rex.pl?res=+209.85.226.0%2F23&type=all&stime=2000-10-02&etime=2009-10-02&cf=1&af=1&page=routing"> http://albatross.ripe.net/cgi-bin/rex.pl?res=+209.85.226.0%2F23&type=all... </a> </p> <p> </p> <p> It was routed by someone else a long time ago and it got a longer prefix announced sometime, guess when? </p> <p> </p> <p> </p> <hr /> <p> </p> <p> </p> <p> Here is a very Dutch ISP: </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=194.109.0.0/16&stime=2000-10-02&etime=2009-10-02&page=geo&cf=1&af=1" title="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=194.109.0.0/16&stime=2000-10-02&etime=2009-10-02&page=geo&cf=1&af=1"> http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=194.109.0.0/16&sti... </a> </p> <p> </p> <p> The DNS tab is also intersting there. Routing has been colorful in the past. </p> <p> </p> <p> </p> <hr /> <p> </p> <p> </p> <p> Let us look at another interesting neighborhood outside the RIPE region: </p> <p> </p> <p> <a href="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=216.34.176.0/20&stime=2000-10-02&etime=2009-10-02&page=dns&cf=1&af=1" title="http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=216.34.176.0/20&stime=2000-10-02&etime=2009-10-02&page=dns&cf=1&af=1"> http://albatross.ripe.net/cgi-bin/rex.pl?type=all&res=216.34.176.0/20&st... </a> </p> <p> </p> <p> Expand the domains by clicking on the <em> <strong> + </strong> </em> s in the table. By combining pulic data from various sources REX is also useful for resources which are not in the RIPE database. Do you have suggestions for information that should be in REX? </p> <p> </p> <p> </p> <hr /> <p> </p> <p> </p> <p> <em> <strong> Can you find interesting and useful things too? Share them here! </strong> </em> </p> <p> </p> <p> </p> </div>
Anonymous •
Is it possible to add a feature for domain names as well?<br />It could be nice to obtain historical DNS records for domains. There are some similar services on the web but their coverage is poor.
Hide replies
Anonymous •
It would be possible, provided that we have a reliable source of historical information on this. Keep in mind though that the seervice focuses on number resorces, so what I could imagine here is a list of domains that somehow used the queried IP addresses.