RIPE Database Workshop

Size: px

Start display at page:

Download "RIPE Database Workshop"

Bridget Lyons
5 years ago
Views:

1 RIPE Database Workshop For Law Enforcements Agencies Minsk, BY 18 April 2017 RIPE NCC LEA Meeting

2 Overview The RIPE Database RIPE Database Queries - IPv4 Basic IPv6 Facts RIPE Database Queries - IPv6 2

3 The RIPE Database Brief Introduction

4 The RIPE Database Public Internet resource and routing registry database - IP addresses, AS Numbers - Contact information - Reverse DNS delegations - Routing policies 4

5 RIPE Database Objects IPs and ASNs - inetnum, inet6num, aut-num Contact - organisation, person, role Routing - route, route6 Reverse DNS - domain Object protection - mntner 5

6 Anatomy of an Object person: Juan Carlos Lopez address: Calle A address: Ciudad Grande Attributes nic-hdl: mnt-by: jclopez@empresa.com CL9876-RIPE SEGURIDAD-MNT Values created: (date & time) last-modified: (date & time) source: RIPE 6

7 Lookup Keys person: address: address: nic-hdl: mnt-by: created: last-modified: source: Juan Carlos Lopez Calle A Ciudad Grande jclopez@empresa.com CL9876-RIPE SEGURIDAD-MNT (date & time) (date & time) RIPE 7

8 Object Templates person: [mandatory] [single] [lookup key] address: [mandatory] [multiple] [ ] phone: [mandatory] [multiple] [ ] fax-no: [optional] [multiple] [ ] [optional] [multiple] [lookup key] org: [optional] [multiple] [inverse key] nic-hdl: [mandatory] [single] [primary/lookup key] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] abus box: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [optional] [multiple] [ ] created: [generated] [single] [ ] last-modified: [generated] [single] [ ] source: [mandatory] [single] [ ] 8

9 Objects Are Related To Each Other IP range org: contact: Organisation contact: Person org: 9

10 Querying the RIPE Database Web interface Command line Full Text Search Restful API (XML/JSON) 10

11 Query Results 11

12 Refining Queries Reduce the amount of objects returned Use options and flags to modify the results 12

13 Results With Related Objects Search term: inetnum: netname: RIPENCC-MEETING-PUBLIC descr: RIPE NCC country: NL admin-c: JDR-RIPE admin-c: BRD-RIPE tech-c: OPS4-RIPE status: ASSIGNED PA mnt-by: RIPE-NCC-MNT created: T07:58:22Z last-modified: T08:34:09Z source: RIPE # Filtered role: RIPE NCC Operations address: Singel 258 address: 1016 AB Amsterdam address: The Netherlands person: Brian Riddle phone: address: IT Manager fax-no: address: RIPE NCC - Operations abus box: abuse@ripe.net person: address: Jochem Singel de 258 Ruig admin-c: JDR-RIPE address: address: RIPE 1016AB NCC Amsterdam admin-c: BRD-RIPE address: address: Singel The 258 Netherlands tech-c: GL7321-RIPE address: phone: 1016AB Amsterdam tech-c: SO2011-RIPE fax-no: route: /21 address: The Netherlands tech-c: TOL666-RIPE nic-hdl: descr: BRD-RIPE RIPE-STOCKHOLM phone: tech-c: route: MG18669-RIPE created: origin: / T11:28:31Z AS fax-no: tech-c: descr: RDM397-RIPE last-modified: mnt-by: RIPE-MEETINGS T16:14:51Z RIPE-NCC-MNT nic-hdl: JDR-RIPE nic-hdl: origin: OPS4-RIPE source: created: AS2121 created: T12:04:37Z RIPE # T12:17:39Z Filtered mnt-by: mnt-by: RIPE-NCC-MNT last-modified: mnt-by: last-modified: RIPE-NCC-MNT T12:04:37Z T12:17:39Z created: created: T10:35:19Z source: T11:04:18Z RIPE # Filtered source: RIPE # Filtered last-modified: last-modified: T12:02:57Z T10:09:25Z mnt-by: RIPE-NCC-MNT source: source: RIPE # Filtered RIPE # Filtered 13

14 Results Without Related Objects Search term: -r inetnum: netname: RIPENCC-MEETING-PUBLIC descr: RIPE NCC country: NL admin-c: JDR-RIPE admin-c: BRD-RIPE tech-c: OPS4-RIPE status: ASSIGNED PA mnt-by: RIPE-NCC-MNT created: T07:58:22Z last-modified: T08:34:09Z source: RIPE # Filtered route: /21 descr: RIPE-STOCKHOLM origin: AS mnt-by: RIPE-NCC-MNT created: T12:17:39Z route: last-modified: / T12:17:39Z descr: source: RIPE-MEETINGS # Filtered origin: AS2121 mnt-by: RIPE-NCC-MNT created: T11:04:18Z last-modified: T10:09:25Z source: RIPE # Filtered 14

15 More Efficient Queries Default query brings back all related objects Use -r and --no-personal flags First find the resources Then look up organisations and persons 15

16 Protecting Objects: Maintainers person: Jasper Jansen address: Singel 258 phone: nic-hdl: JJ357-RIPE mnt-by: PROTECT-MNT source: RIPE # Filtered mntner: auth: auth: auth: mnt-by: source: PROTECT-MNT MD5-PW $1$crypto-stuff SSO @domain.com PGP-KEY Some-Key-Obj PROTECT-MNT RIPE # Filtered 16

17 Live Demo RIPE Database

18 RIPE Database Queries IPv4

19 IPv4 Address Distribution /0 IANA /8 RIR /22 LIR /23 /25 /24 End User Allocation PA Assignment PI Assignment 19

From One IP Address Connection Network ISP 192.168.16.0 /20 192.168.29.

20 From One IP Address Connection Network ISP / / IP Address Assignment Allocation 20

21 IPv4 objects: inetnum status TYPE Allocation PA Assignment Sub-allocation PI Assignment INETNUM STATUS ALLOCATED PA ASSIGNED PA SUB-ALLOCATED PA ASSIGNED PI 21

22 IPv4 PA Assignment inetnum: netname: RIPENCC-MEETING-PUBLIC descr: Reseaux IP Europeens Network Coordination Centre country: NL admin-c: JDR-RIPE admin-c: BRD-RIPE tech-c: OPS4-RIPE status: ASSIGNED PA mnt-by: RIPE-NCC-MNT mnt-routes: RIPE-NCC-MNT mnt-domains: RIPE-NCC-MNT created: T14:42:14Z last-modified: T14:42:14Z source: RIPE # Filtered 22

23 IPv4 PA Allocation inetnum: netname: NL-RIPENCC-TS descr: Reseaux IP Europeens Network Coordination Centre country: NL org: ORG-Bb2-RIPE admin-c: JDR-RIPE admin-c: BRD-RIPE tech-c: OPS4-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: RIPE-NCC-MNT mnt-routes: RIPE-NCC-MNT mnt-domains: RIPE-NCC-MNT created: T11:04:17Z last-modified: T08:49:39Z source: RIPE # Filtered 23

24 IPv4 PA Sub-Allocation inetnum: netname: MAGIC-ONLINE descr: IP Pool for DSL Services descr: Gaoland country: FR admin-c: EC4108-RIPE tech-c: EC4108-RIPE status: SUB-ALLOCATED PA remarks: ********************************************** remarks: * For spam & abuse issues to abus@magic.fr * remarks: ********************************************** mnt-by: LDCOM-MNT created: T14:11:01Z last-modified: T09:56:20Z source: RIPE # Filtered 24

25 IPv4 PI Assignment inetnum: netname: UNI-INVEST-NET descr: UNIVERSAL INVESTMENT GMBH country: DE org: ORG-UIG1-RIPE sponsoring-org: ORG-CI9-RIPE admin-c: TD3339-RIPE tech-c: TD3339-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-END-MNT mnt-by: EU-COLT-MNT mnt-routes: EU-COLT-MNT mnt-domains: EU-COLT-MNT created: T11:17:38Z last-modified: T01:47:35Z source: RIPE # Filtered 25

26 Navigating the Hierarchy With PA space, you want to find what is under or above the inetnum object - Under = More Specific - Above = Less Specific There are flags: -m, -M, -l, -L Also in the Hierarchy Flags tab 26

27 More Specific inetnums: -m -m / /21 /24 /26 /25 27

28 More Specific inetnums: -M -M / /21 /24 /26 /25 /26 28

29 Less Specific inetnums: -l -l / / /24 29

30 Less Specific inetnums: -L -L /24 0/0 193/ / /24 30

31 Hierarchy Flags Tab 31

32 Relation between IP and LIR ALLOCATION ORGANISATION ASSIGNMENT ROLE PERSON PERSON IP ADDRESS PERSON 32

33 Contact Information Objects have contact information Organisation - org: points to an organisation object admin-c, tech-c, zone-c, abuse-c - point to person/role objects 33

34 Organisation Object organisation: ORG-KL71-RIPE org-name: KIEVLINE LLC org-type: LIR remarks: address: PO Box 88 address: address: Kiev address: UKRAINE phone: fax-no: admin-c: OB577-RIPE admin-c: SR8953-RIPE abuse-c: AR20175-RIPE mnt-ref: RIPE-NCC-HM-MNT mnt-ref: KIEVLINE-MNT mnt-by: RIPE-NCC-HM-MNT mnt-by: KIEVLINE-MNT created: T09:15:12Z last-modified: T12:32:23Z source: RIPE 34

35 Role Object role: Taras Shevchenko Kiev University NOC address: Kiev, Ukraine Volodymyrska st, 64 phone: remarks: trouble: Abuse-related reports and troubles remarks: trouble: Routing-related reports and troubles admin-c: RS12003-RIPE tech-c: RS12003-RIPE nic-hdl: KUN1-RIPE mnt-by: AS13032-MNT created: T14:38:48Z last-modified: T13:17:38Z source: RIPE 35

36 Person Object person: Roman Sinyuk address: Taras Shevchenko Kiev University address: Kiev,Ukraine address: Volodymyrska st, 64 phone: fax-no: nic-hdl: RS12003-RIPE mnt-by: AS13032-MNT created: T00:00:00Z last-modified: T22:59:07Z source: RIPE 36

37 Live Demo IPv4 Queries

38 Questions

39 Basic IPv6 Facts The WHY, WHAT and HOW

40 Why IPv6? IPv4 = ~4 billion possible addresses Not enough for everybody to connect NAT extends the possibilities of IPv4, but - Has performance issues - Difficult to track users 40

41 What is IPv6? 128 bits address space = addresses Notation in CIDR is similar to IPv4 - /128 = one IPv6 address - /64 = one subnet - /56 - /48 = typical assignment sizes - /32 = minimum allocation 41

42 IPv6 Address Distribution 42

43 IPv6 Address Distribution /3 IANA /12 RIR /32 LIR /48 /56 /48 End User Allocation PA Assignment PI Assignment 43

44 Multiple address types Addresses Range Scope Unspecified ::/128 n/a Loopback ::1 host Link Local fe80::/10 link Unique Local fc00::/7 global Global Unicast 2000::/3 global Multicast ff00::/8 variable 44

45 Address Notation 2001:0db8:003e:ef11:0000:0000:c100:004d 2001: 0db8: 003e:ef11: 0000: 0000: c100: 004d 2001:db8:3e:ef11:0:0:c100:4d Double colon :: can only be used once 45

46 IPv6 Subnetting 4 bits :0DB8:0000:0000:0000:0000:0000: bits interface ID /64 /60 = 16 /64 /56 = 256 /64 /52 = 4096 /64 /48 = /64 /32 = /48 46

47 Address Auto-Configuration Interface ID is made from the MAC address 48 bits - MAC Address FF FE Prefix Interface ID Modified EUI-64 47

48 Privacy Extensions Changes the interface ID over time The prefix stays the same while connected to network 2001:0DB8:0000:0000:0000:0000:0000:0000 Prefix remains the same Interface ID changes 48

49 Interfaces have multiple addresses Link Local Self-generated - No Internet fe80::6676:baff:fe98:d5e Unique Local Just like private IPv4 - No Internet fda3:3dcb:ebee::6676:baff:fe98:d5e Global Unicast From /64 - Public Internet 2001:db8:2e8:13:6676:baff:fe98:d5e 2001:db8:2e8:13:694a:1337:8ed4:77b3 49

50 IPv6 Assignments IPs? Subnets! 1 subnet = /64 18,446,744,073,709,551,616 addresses 50

51 IPv6 Assignments /64 /60 /56 /52 /48 > /48 no approval required approval required Smaller block size Larger block size Prefix Number of /64 subnets /64 1 /60 16 / / /

52 IPv6 Assignments /64 52

53 IPv6 Assignments /56 /48 53

54 IPv6 Assignments Internet /48 54

55 Aggregation in IPv6 /64 /64 /64 /64 /56 /56 /56 /56 /48 /48 /48 /48 /52 /36 /36 /32 55

56 Questions

57 RIPE Database Queries IPv6

58 From One IP Address Connection Network ISP 2001:db8::/ :db8:15:9:ca1:2e:f6:b3b0 / :db8:15::/ :db8:15:9::/64 /64 /48 IP Address / Subnet Assignment Allocation 58

59 IPv6 objects: inet6num status TYPE Allocation PA Assignment Group of Assignments Sub-allocation PI Assignment INET6NUM STATUS ALLOCATED-BY-RIR ASSIGNED AGGREGATED-BY-LIR ALLOCATED-BY LIR ASSIGNED PI 59

60 IPv6 PA Assignment inet6num: 2a02:9010:87::/48 netname: TGT descr: TGT descr: Internet Public Addresses descr: country: ES admin-c: FA4939-RIPE tech-c: FA4939-RIPE status: ASSIGNED mnt-by: MAINT-AS3352 created: T11:45:58Z last-modified: T11:45:58Z source: RIPE 60

61 IPv6 Group of PA Assignments inet6num: 2a01:b600:e000::/36 netname: EHIWEB-IPV6-DYN-1 descr: Ehiweb xdsl IPv6 Dynamic Addresses 1st Pool country: IT org: ORG-ES53-RIPE admin-c: MS17084-RIPE tech-c: MS17084-RIPE status: AGGREGATED-BY-LIR assignment-size: 48 mnt-by: MNT-EHIWEB created: T11:38:56Z last-modified: T11:38:56Z source: RIPE # Filtered 61

62 AGGREGATED-BY-LIR ALLOCATED-BY-RIR AGGREGATED-BY-LIR assignment-size: 48 /36 /48 /48 /48 /48 /48 Used to group customers - example: residential broadband customers assignment size: = assignment of each customer 62

63 IPv6 Allocation inet6num: netname: descr: country: org: admin-c: tech-c: status: mnt-by: mnt-lower: mnt-routes: created: last-modified: source: 2a02:9000::/23 ES-TELEFONICA Telefonica de Espana ES ORG-TDE1-RIPE ATdE1-RIPE TTdE1-RIPE ALLOCATED-BY-RIR RIPE-NCC-HM-MNT MAINT-AS3352 MAINT-AS T17:17:14Z T17:17:14Z RIPE # Filtered 63

64 IPv6 Sub-Allocation inet6num: netname: descr: country: admin-c: tech-c: remarks: mnt-by: status: created: last-modified: source: 2001:7b8:1000::/36 NL-BIT2 BIT IPv6 deployment NL BIT-RIPE BIT-RIPE For information, contact the NOC BIT-MNT ALLOCATED-BY-LIR T18:36:30Z T08:32:11Z RIPE # Filtered 64

65 IPv6 PI Assignment inet6num: netname: descr: country: org: sponsoring-org: admin-c: tech-c: status: mnt-by: mnt-by: mnt-routes: mnt-domains: created: last-modified: source: 2001:67c:29cc::/48 HCS-V6-NET HCS HEALTH COMMUNICATION SERVICE GMBH AT ORG-HHCS1-RIPE ORG-iEWA1-RIPE WW85-RIPE WW85-RIPE ASSIGNED PI RIPE-NCC-END-MNT AS3330-MNT AS3330-MNT AS3330-MNT T09:26:00Z T13:49:51Z RIPE # Filtered 65

66 More Specific inet6nums: -m -m 2a00:c28::/32 2a00:c28::/32 /36 /64 /48 66

67 More Specific inet6nums: -M -M 2a00:c28::/32 2a00:c28::/32 /36 /64 /48 /56 67

68 Less Specific inet6nums: -l -l 2a00:c28:a1b2::/48 2a00:c28::/32 2a00:c28:a1b2::/48 68

69 Less Specific inet6nums: -L -L 2a00:c28:a1b2::/48 ::/0 2a00::/12 2a00:c28::/32 2a00:c28:a1b2::/48 69

70 Contact Information The same as IPv4 Find the ALLOCATION Follow to the ORGANISATION ALLOCATION ORGANISATION 70

71 Live Demo IPv6 Queries

72 Questions

73 Extra RIPE Database Inverse Lookups Full Text Search

74 Inverse Lookup Finding all objects in which an object is referenced ORGANISATION ALLOCATION ALLOCATION ALLOCATION ALLOCATION 74

75 Inverse Lookup 75

76 Referenced person object inet6num: descr: mnt-by: org: admin-c: tech-c: 2001:db8::/32 my IPv6 range RIPE-NCC-HM-MNT ORG-BB2-RIPE JE777-RIPE JD1-RIPE aut-num: descr: mnt-by: org: admin-c: tech-c: AS64551 my AS number RIPE-NCC-HM-MNT ORG-BB2-RIPE JD1-RIPE LA789-RIPE -i admin-c JD1-RIPE mntner: LIR-MNT person: John Smith admin-c: tech-c: mnt-by: role: nic-hdl: admin-c: address: JD1-RIPE LA789-RIPE LIR-MNT Bluelight Staff BLS77-RIPE JD1-RIPE Sesame Street 1 staff@example.org nic-hdl: address: phone: mnt-by: JD1-RIPE Sesame Street john@example.org LIR-MNT 76

77 Referenced person object inet6num: descr: mnt-by: org: admin-c: tech-c: aut-num: descr: mnt-by: org: tech-c: tech-c: 2001:db8::/32 my IPv6 range RIPE-NCC-HM-MNT ORG-BB2-RIPE JE777-RIPE JD1-RIPE AS64551 my AS number RIPE-NCC-HM-MNT ORG-BB2-RIPE JD1-RIPE LA789-RIPE -i person JD1-RIPE mntner: LIR-MNT person: John Smith admin-c: tech-c: mnt-by: role: nic-hdl: admin-c: address: JD1-RIPE LA789-RIPE LIR-MNT Bluelight Staff BLS77-RIPE JD1-RIPE Sesame Street 1 staff@example.org nic-hdl: address: phone: mnt-by: JD1-RIPE Sesame Street john@example.org LIR-MNT 77

78 Referenced Organisation inet6num: descr: org: admin-c: tech-c: 2001:db8::/32 My IPv6 range ORG-BB2-RIPE JE777-RIPE JD1-RIPE inetnum: /21 descr: My v4 allocation org: ORG-BB2-RIPE admin-c: JE777-RIPE tech-c: JD1-RIPE inetnum: /21 descr: Other v4 allocation org: ORG-BB2-RIPE admin-c: JE777-RIPE tech-c: JD1-RIPE aut-num: AS64551 descr: my AS number org: ORG-BB2-RIPE admin-c: JE777-RIPE tech-c: JD1-RIPE -i org ORG-BB2-RIPE organisation: ORG-BB2-RIPE admin-c: JD1-RIPE tech-c: LA789-RIPE abuse-c: AR789-RIPE mnt-by: LIR-MNT 78

79 Full Text Search 79

80 Full Text Search - Advanced 80

81 Other Database Objects route / route6 / domain

82 Route objects inetnum: /21 aut-num: AS65535 tech-c: LA789-RIPE tech-c: LA789-RIPE admin-c: JD1-RIPE admin-c: JD1-RIPE mnt-by: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-END-MNT mnt-routes: LIR-MNT mnt-by: LIR-MNT route: /21 tech-c: admin-c: origin: mnt-by: LA789-RIPE JD1-RIPE AS65535 LIR-MNT 82

83 Example route object route: /21 descr: The Demo Network origin: AS65535 mnt-by: LIR-MNT created: T12:14:23Z last-modified: T12:14:23Z source: RIPE # Filtered 83

84 Route6 objects inetnum: 2001:db8::/32 aut-num: AS65535 tech-c: LA789-RIPE tech-c: LA789-RIPE admin-c: JD1-RIPE admin-c: JD1-RIPE mnt-by: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-END-MNT mnt-routes: LIR-MNT mnt-by: LIR-MNT route: 2001:db8::/32 tech-c: LA789-RIPE admin-c: JD1-RIPE origin: AS65535 mnt-by: LIR-MNT 84

85 Example route6 object route6: descr: origin: mnt-lower: mnt-routes: mnt-by: created: last-modified: source: 2001:67c:2e8::/48 RIPE-NCC AS3333 RIPE-NCC-MNT RIPE-NCC-MNT RIPE-NCC-MNT T12:14:23Z T12:14:23Z RIPE # Filtered 85

86 IPv4 domain objects For reverse delegation Using domain objects - Creates glue records on RIPE NCC name servers /24 and /16 block sizes in-addr.arpa zone Domain points to the authoritative NS 86

87 Example domain object domain: descr: admin-c: tech-c: zone-c: nserver: nserver: nserver: nserver: nserver: mnt-by: mnt-by: created: last-modified: source: in-addr.arpa RIPE MEETING JDR-RIPE OPS4-RIPE OPS4-RIPE pri.authdns.ripe.net sns-pb.isc.org sec1.apnic.net ns3.nic.fr tinnie.arin.net RIPE-NCC-MNT RIPE-GII-MNT T13:14:45Z T16:39:06Z RIPE # Filtered 87

88 IPv6 domain objects For reverse DNS Using domain objects - Creates glue records on RIPE NCC name servers 4-bit boundary: /48, /44, /40, /36, /32 ip6.arpa zone Domain object points to the authoritative NS 88

89 Example domain object domain: descr: admin-c: tech-c: zone-c: nserver: nserver: nserver: nserver: nserver: mnt-by: created: last-modified: source: 0.e.0.0.c ip6.arpa RIPE NCC External DNS Infrastructure GII-RIPE GII-RIPE GII-RIPE pri.authdns.ripe.net sns-pb.isc.org sec1.apnic.net ns3.nic.fr tinnie.arin.net RIPE-GII-MNT T15:15:36Z T12:30:22Z RIPE # Filtered 89

90 Questions

91 Lõpp Fine The End! Einde Соңы Kрай Fí Liðugt Ende Finvezh Konec Kraj Ënn Fund Beigas הסוף Vége Son An Críoch Y Diwedd Finis Kiнець Kpaj Endir Sfârşit Fin Τέλος Конeц Slut Slutt Pabaiga Fim Amaia Loppu Tmiem Koniec

MANRS How to behave on the internet

MANRS How to behave on the internet Massimiliano Stucchi TOP-IX Meeting January 2017 BGP BGP is based on trust - No built-in validation - Chain of trust is hard to establish - Data scattered over different