Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I haven't cracked open the source code yet, but I was curious which whois service the traceroute program uses to look up ASNs for a given IP.

share|improve this question

2 Answers 2

up vote 8 down vote accepted

The copy running on my Linux box gets its answers from 198.108.0.18. I was able to tell this by running tcpdump at the same time as running a traceroute.

The PTR records for that IP resolve to rpsl-p.merit.edu, and it happens that whois.radb.net. and whois.ra.net. point to the same IP address.

Further examination of the binary (with "strings") reveals that it's actually using the whois.radb.net hostname. There's also a pair of (undocumented) environment variables ($RA_SERVER and $RA_SERVICE) which can change the host and port used for these queries.

share|improve this answer
    
How did you determine that? –  Noah Campbell Jun 11 '09 at 19:48
    
I ran tcpdump at the same time as a traceroute. –  Alnitak Jun 11 '09 at 20:31

Having not looked at the source code, I would suspect either whois.ra.net or riswhois.ripe.net or equivalent.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.