looking for operator validation for regexes that extract ASNs

Mon May 11 08:03:40 UTC 2020

Hi NANOG

To support Internet topology analysis efforts, we have been working on
an algorithm to detect AS numbers inside hostnames (PTR records) for
router interfaces, and automatically build regular expressions
(regexes) to extract them.  Specifically, we are looking at operators
who embed the ASN of their neighbor in the hostname when they provide
the IP address to the neighbor for interconnection.  For example,
suppose we had the following three hostnames in the gtt.net domain
suffix, which we believed to be assigned to routers operated by ASes
1215, 1273, and 10835

as1215.xe-7-0-6.ar2.sjc1.us.as4436.gtt.net
as1273.hkg11.ip4.gtt.net
as10835.cr3-sea2.ip4.gtt.net

We might infer the regex ^as(\d+)\..+\.gtt\.net$ extracts these ASNs
and reflects GTT practice to name these IP addresses they assigned to
neighbors with the ASN that operates the router.

We're at the stage where we are asking for broader feedback from
operators.  The webpage at https://www.caida.org/~mjl/rnc/asn/ shows
the inferences our algorithm made for 219 domains.  If you operate one
of the domains in that list, we would appreciate it if you could
comment (private is probably better but public is fine with me) on
whether the regex our algorithm inferred represents your naming
intent.  In the first instance, we are most interested in feedback for
the suffix / date combinations for suffixes that are colored green or
orange, i.e. appear to be reasonable.

Each suffix / date combination links to a page that contains the
naming convention and corresponding inferences.  The colored part of
each hostname is the ASN extracted by the regex.  The green hostnames
appear to be correct, at least as far as the algorithm determined.
Some suffixes have errors due to either stale hostnames or incorrect
training data, and those hostnames are colored red.  We'd appreciate
particular feedback for the red hostnames -- was the hostname stale,
or the training data incorrect?

Thanks,

Matthew
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20200511/608c8715/attachment.sig>