Geoip lookup

Thu May 23 22:34:56 UTC 2013

On Thu, May 23, 2013 at 5:36 PM, Joe Abley <jabley at hopcount.ca> wrote:
>
> On 2013-05-23, at 16:56, shawn wilson <ag4ve.us at gmail.com> wrote:
>
>> It looks you're right and everyone does have the same data in
>> historical format. Looks like RIPE has everything compiled into what
>> is current. So if a block hasn't changed for 10 years, it'll be in the
>> RIPE dataset vs with the others, I'd have to write something to
>> overlay the data through out time to get current?
>
> Could be. You've looked at this more than I have, now -- I was mainly trying to point out that bulk data retrieval is a possible option so you could avoid whois-hammering

Actually, I can't find anything better, so I think i'm going to query
the bottom of ranges like so:
 % dig +short 0.0.66.77.origin.asn.cymru.com TXT
"16245 | 77.66.0.0/17 | DK | ripencc | 2007-01-24"
 % dig +short 0.0.65.77.origin.asn.cymru.com TXT
"13110 | 77.65.0.0/17 | PL | ripencc | 2007-01-17"

According to their web site, they won't block me if I don't do
anything stupid "If you are planning on implementing the use of this
service in any software, application, or device PLEASE let us know in
advance. We would like to adequately plan for capacity and make sure
that we can adequately handle the load. If at all possible, PLEASE use
the DNS based service since it is faster and more efficient,
particularly for larger deployments of individual IP based queries."
http://www.team-cymru.org/Services/ip-to-asn.html#dns
and use this https://metacpan.org/module/MRSAM/Net-CIDR-0.17/CIDR.pm
to find my upper ranges.

So, I'm pretty much thinking about whois-hammering still :(

Also, I just picked those IPs at random (ie, start at one end of the
number, hit twice, dot, next number) nothing particularly interresting
about whoever that is AFAIK.