AS information available via DNS

[Tony Bates <]

Folks,

	As one of the actions from the  last RIPE meeting we have been thinking
about a nice way to have an automatic update procedure based on DNS. As a
trial for this an auto-script has been been produced that loads current
AS derived data into zonefiles under the domain aut-num.ripe.net. This
has two very nice features straight away. It allows you to see a list of
networks associated with an AS. For example...


[mature-tony-1480] host -lt txt as1104.aut-num.ripe.net
AS1104.aut-num.ripe.net TXT     192.16.185.0
AS1104.aut-num.ripe.net TXT     192.16.186.0
AS1104.aut-num.ripe.net TXT     192.16.194.0
AS1104.aut-num.ripe.net TXT     192.16.195.0
AS1104.aut-num.ripe.net TXT     192.16.199.0
AS1104.aut-num.ripe.net TXT     192.87.45.0


I currently use TXT records for the zonefiles (suggestions are welcome if
something else is more appropriate ?).


Also, you can do more interesting things like perhaps generate access-lists..
For Example...

[mature-tony-1482] host -lt txt as1104.aut-num.ripe.net | awk '{ printf ("acces
s-list 30 permit %s\n", $3)}'
access-list 30 permit 192.16.185.0
access-list 30 permit 192.16.186.0
access-list 30 permit 192.16.194.0
access-list 30 permit 192.16.195.0
access-list 30 permit 192.16.199.0
access-list 30 permit 192.87.45.0


and so on.


You can also see what ASes are currently in the RIPE database.

host -lt ns aut-num.ripe.net
aut-num.ripe.net        NS      mature.ripe.net
AS760.aut-num.ripe.net  NS      mature.ripe.net
AS766.aut-num.ripe.net  NS      mature.ripe.net
AS590.aut-num.ripe.net  NS      mature.ripe.net
NONE-LOCAL.aut-num.ripe.net     NS      mature.ripe.net
AS1717.aut-num.ripe.net NS      mature.ripe.net
AS2107.aut-num.ripe.net NS      mature.ripe.net
AS2108.aut-num.ripe.net NS      mature.ripe.net
AS2111.aut-num.ripe.net NS      mature.ripe.net
AS1205.aut-num.ripe.net NS      mature.ripe.net
AS786.aut-num.ripe.net  NS      mature.ripe.net
AS2116.aut-num.ripe.net NS      mature.ripe.net
AS789.aut-num.ripe.net  NS      mature.ripe.net
AS1213.aut-num.ripe.net NS      mature.ripe.net
AS2119.aut-num.ripe.net NS      mature.ripe.net
AS1899.aut-num.ripe.net NS      mature.ripe.net
AS2122.aut-num.ripe.net NS      mature.ripe.net
AS1739.aut-num.ripe.net NS      mature.ripe.net
AS1741.aut-num.ripe.net NS      mature.ripe.net
AS1923.aut-num.ripe.net NS      mature.ripe.net
AS1752.aut-num.ripe.net NS      mature.ripe.net
AS1755.aut-num.ripe.net NS      mature.ripe.net
AS1241.aut-num.ripe.net NS      mature.ripe.net
AS2148.aut-num.ripe.net NS      mature.ripe.net
AS137.aut-num.ripe.net  NS      mature.ripe.net
AS1770.aut-num.ripe.net NS      mature.ripe.net
AS513.aut-num.ripe.net  NS      mature.ripe.net
AS1257.aut-num.ripe.net NS      mature.ripe.net
AS2004.aut-num.ripe.net NS      mature.ripe.net
AS517.aut-num.ripe.net  NS      mature.ripe.net
AS679.aut-num.ripe.net  NS      mature.ripe.net
AS1104.aut-num.ripe.net NS      mature.ripe.net
AS1267.aut-num.ripe.net NS      mature.ripe.net
AS1274.aut-num.ripe.net NS      mature.ripe.net
AS1275.aut-num.ripe.net NS      mature.ripe.net
AS697.aut-num.ripe.net  NS      mature.ripe.net
AS174.aut-num.ripe.net  NS      mature.ripe.net
AS719.aut-num.ripe.net  NS      mature.ripe.net
AS544.aut-num.ripe.net  NS      mature.ripe.net
AS1290.aut-num.ripe.net NS      mature.ripe.net
AS2380.aut-num.ripe.net NS      mature.ripe.net
AS2036.aut-num.ripe.net NS      mature.ripe.net
AS553.aut-num.ripe.net  NS      mature.ripe.net
AS2043.aut-num.ripe.net NS      mature.ripe.net
AS1324.aut-num.ripe.net NS      mature.ripe.net
AS559.aut-num.ripe.net  NS      mature.ripe.net
AS378.aut-num.ripe.net  NS      mature.ripe.net
AS1849.aut-num.ripe.net NS      mature.ripe.net
NONE.aut-num.ripe.net   NS      mature.ripe.net
AS1853.aut-num.ripe.net NS      mature.ripe.net
AS565.aut-num.ripe.net  NS      mature.ripe.net
AS224.aut-num.ripe.net  NS      mature.ripe.net
AS60.aut-num.ripe.net   NS      mature.ripe.net

The NONE and NONE-LOCAL zones are not currently loaded.

The second aspect of this is the possibilty of having an update procedure based
on DNS. Here we could delegate the zone to the "guardian" and if we provided a
consistency checking tool to avoid conflicts it would be a nice "dynamic"
mechanism for updating AS information. We would like to go this way if you feel
using DNS is reasonable as opposed to using some form of login/ftp mechanism
as previous used for ripe-60 tags and planned for ripe-81.

Please let us know your views on this and also please try looking at the
information in the aut-num.ripe.net zone.


--Tony