All and smallest CIDR, updated date of whois record

[wallyw1]

(1) Can all CIDR in screenshot A be retrieved?

(2) I would like to confirm how CIDR in "nets" is retrieved, is it calculated from inetnum (1, screenshot B)?

(3) For "updated" in "nets", is it calculated from "changed"? But for multiple "changed" rows (2, screenshot B), the "updated" is calculated from the oldest row (20020923), not the latest one (20040211).

(4) Sometimes whois record includes possibly smallest CIDR (4, screenshot B), can it be retrieved as "CIDR" in "nets" (I wonder will this smallest CIDR more suitable for "CIDR" in "nets")?

[secynic]

1. What do you mean retrieved? Each IP address in that range?

2. Yes. Each inetnum/inet6num/NetRange starts a new section for parsing. Each one should be in the nets dict.

3. Updated is calculated from changed/Updated/etc. You can see what it is looking for in the NIC_WHOIS dictionary. It seems from your report that there may be a bug. I will look in to this.

4. This should be the case. I will check this.

I am working on the next update, and will include updates for any bugs i find from your input. Thanks.

[chorsley]

Regarding point 1), I think @wal1ybot is referring to the fact that there are 3 AS CIDRs announced for this IP, but ipwhois returns only one of those back. e.g.:

>>> ipwhois.IPWhois("202.173.92.56").lookup()
{'asn': '23695',
 'asn_cidr': '202.173.92.0/22',
 'asn_country_code': 'ID',
...

It would be very useful to get all three AS CIDRs back here, in much the same way as we do for net_cidr. If Cymru's whois service is being used, which only seems to return a single AS CIDR, perhaps a new source of this data would be required?

Additionally, it seems that the asn_cidr that gets returned may occasionally change from query to query, in my experience (not often, but just enough to make comparisons difficult).

[secynic]

Understood. I do not know of a good/reliable Team Cymru alternative currently. Please tell me if you know of one.

If you can, please provide an example of the asn_cidr changing (screenshots preferably).

[wallyw1]

Sorry for my late reply.

Thanks @chorsley a lot to explain for me. So, @secynic, I didn't know any good alternative at this moment. If it is impossible to 'fix' it without an alternative, maybe I move (1) to another issue for later exploration?

[secynic]

I will fix whatever needs to be fixed per my above comments on questions 1-4. Since a more detailed alternative to Cymru may be a long term issue, please open a new issue for tracking that.

[secynic]

Ok, 3 & 4 were both related to the same issue. I updated the CIDR regex parsing for the NICs (except ARIN). That was a bug, and will be pushing fix soon.

[secynic]

Fixed in #52