I haven't cracked open the source code yet, but I was curious which whois service the traceroute program uses to look up ASNs for a given IP.
I haven't cracked open the source code yet, but I was curious which whois service the traceroute program uses to look up ASNs for a given IP.
The copy running on my Linux box gets its answers from
198.108.0.18
. I was able to tell this by runningtcpdump
at the same time as running atraceroute
.The PTR records for that IP resolve to
rpsl-p.merit.edu
, and it happens thatwhois.radb.net.
andwhois.ra.net.
point to the same IP address.Further examination of the binary (with "
strings
") reveals that it's actually using thewhois.radb.net
hostname. There's also a pair of (undocumented) environment variables ($RA_SERVER
and$RA_SERVICE
) which can change the host and port used for these queries.Having not looked at the source code, I would suspect either whois.ra.net or riswhois.ripe.net or equivalent.