#!/usr/bin/env python import re, cymruwhois from sys import argv, stdin from iptools import IpRange, IpRangeList private_nets = IpRangeList("10/8", "172.16/12", "192.168/16") ip_re = re.compile(r'^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])') def iprangelistappend(match, rangelist): rangelist.ips += (IpRange(match.prefix),) return (match.prefix, match.owner) def main(input): ips = sorted(set(ip_re.match(line).group(0) for line in input if ip_re.match(line))) ips = filter(lambda ip: ip not in private_nets, ips) public_nets = IpRangeList() whois = cymruwhois.Client() nets = (iprangelistappend(whois.lookup(ip), public_nets) for ip in ips if ip not in public_nets) for prefix, owner in nets: print prefix, owner if __name__ == "__main__": if len(argv) == 1: main(stdin) else: main(open(argv[2]))
109.171.0.0/17 ZSTTKAS JSC Zap-SibTranstelecomYou can ask a legitimate question - why are there different providers in the output? and why does the owner appear at all? I answer. Logs that I fed to the script for a fairly long period of time, to minimize the chance of overlooking the subnet. During this time, as I believe, there has been a redistribution of addresses. So, whatever one may say, but you still have to control the process.
176.196.0.0/15 ELIGHT-AS E-Light-Telecom
178.171.0.0/17 ELIGHT-AS E-Light-Telecom
195.161.0.0/16 RTCOMM-AS OJSC RTComm.RU
212.75.192.0/19 ELIGHT-AS E-Light-Telecom
46.180.0.0/15 ELIGHT-AS E-Light-Telecom
………
cat userip.log | grep 10.110.1.10 | cut -d";" -f 1 | ./exctract_nets.py;
works on my core-i5, on a log with 4418365 entries, in 19 seconds. So do not be surprised if you do not see the output for a long time.Source: https://habr.com/ru/post/127822/
All Articles