Honeynor Country Lookup

This service will provide you with AS-numbers, IPv4 and IPv6 prefixes belonging to a specific country. As input, use ISO-3166-1 alpha-2 country codes (more info).

Web-based query

To query the database through a web browser, simply goto this page and enter your desired country code and select the type of query (ASN, IPv4, IPv6 or ALL to list everyting).

CLI-based query

If you're a fan of the command line (like me), then you may query the database by using a whois client. The input syntax is quite simple:

<TYPE> CC

Examples

List AS-numbers registered for Norway:

$ whois -h atari.honeynor.no no

List IPv4 prefixes for Kenya

$ whois -h atari.honeynor.no ipv4 ke

List everything (ASN + IPv4 + IPv6) for Malta

$ whois -h atari.honeynor.no all mt

You can of course also just open a generic socket to the listening port and write the query. In the example below I use Netcat. Actually using netcat is the preferred way as the whois client in some cases doesn't properly read all the data sent over the socket (see the caveat section).

$ echo "ipv4 us" | nc atari.honeynor.no 43

Downloadables

If you for some reason would like to download the information from our database in the form of an compressed tar file, just access this page (sorry no FTP available).

On this page you can either download a specific country package (containing ASN, IPv4 and IPv6 for that country) or packages containing all ASN, IPv4 or IPv6 files. The file "ALL.tar.bz2" contains the whole database.

Enhanced Database

A major issue with the RIR data, is ASNs registered to a region instead of a specific country. There are currently two regions in use; European Union (EU) and Asia Pacific (AP). The reason for using this is the ever increasing globalization of corporations and organizations. But when you want a list of AS numbers for any given country code, the regional registrations have to be included.

This is where the enhanced database comes into action. In this database we've manually overridden the country code assignments for those ASNs that in the RIR data were registered to either EU or AP. In addition we've also corrected a few other ASNs that we knew had a wrong country code. The list we've compiled is publicly available: asn_override.txt.

So, how exactly have we done this?

It's all been a manual job, going through all the EU and AP ASNs, plus a good portion of the CCs also. The CC override decision is based on one or more of the following actions:

Using the EDB

From the web-interface make sure you check the box labeled "Use Enhanced Database". The database is also available from command line through netcat (see caveats section below) by using destination port 44 instead of 43.

$ echo "GB" | nc atari.honeynor.no 44

Please note that you can only get ASNs from this database, not IPv4 or IPv6 prefixes. Also note that 4-byte ASNs are represented in ASPLAIN notation (compared to querying the normal database, where you may get both ASPLAIN and ASDOT).

Like the normal database, the enhanced database in its entirety is also available for direct download: EDB.tar.bz2.

About the system

The data is all based on publicly available information from the five RIRs in the world (ARIN, RIPE NCC, APNIC, LACNIC and AfriNIC) which are updated once every day.

These are the backend scripts:

Caveats

A small portion of the data (some IPv4 prefixes) have been correlated with other data sources to correct some inconsistencies. However, some still remain. For instance, UNINETT (the Norwegian research network) is registered with an EU code in the RIPE NCC data, and hence is missing from the result when searching "NO". And there are probably other similar examples as well. Therefore the list of AS-numbers, IPv4 and IPv6 prefixes may not be 100% accurate. The enhanced database (see above) is addressing this issue, and we're confident that the edb is more accurate than the raw RIR data.

Another caveat important to be aware of, is the limitation of the standard whois client, as it was never designed for this kind of use. For queries with a large result set, the client may terminate (usually returning with "fgets: connection reset by peer"). One solution to this is using netcat instead of the whois client.

$ echo "US" | nc atari.honeynor.no 43

Netcat will make sure you get all the data you requested from the server.