A Python tool that queries ARIN's RDAP API to find all IPv4 network blocks owned by an organization and intelligently aggregates them into the largest possible CIDR blocks. Perfect for generating static routing tables.
- Search organizations by name in ARIN's database
- Retrieve all IPv4 network allocations for an organization
- Intelligent subnet aggregation using "walk up the tree" algorithm
- Combines adjacent networks into larger CIDR blocks
- Outputs clean text files with one CIDR per line
- Handles API rate limiting and errors gracefully
- Clone this repository:
git clone <repository-url>
cd whois-netblock-scanner- Create and activate a virtual environment:
python3 -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate- Install dependencies:
pip install -r requirements.txtpython -m whois_scanner "Organization Name"This will:
- Search for the organization in ARIN
- Retrieve all IPv4 networks
- Aggregate them into the largest possible blocks
- Save results to
{ORG-HANDLE}_networks.txt
# Search for Google's networks
python -m whois_scanner "Google LLC"
# Search Amazon and specify output file
python -m whois_scanner "Amazon.com, Inc." -o amazon_networks.txt
# Get Microsoft networks without aggregation
python -m whois_scanner "Microsoft Corporation" --no-aggregate
# Verbose output with statistics
python -m whois_scanner "Cloudflare, Inc." -vorg_name- Organization name to search for (required)-o, --output FILE- Output file path (default:{ORG-HANDLE}_networks.txt)--no-aggregate- Skip aggregation, output all networks as-is-v, --verbose- Show detailed progress and statistics--max-entities N- Limit processing to first N matching entities (useful for organizations with many subsidiaries)
The output file contains:
- Header comments with organization info and timestamp
- One CIDR block per line
- Networks sorted by IP address
Example output:
# Networks for: Google LLC (GOGL)
# Generated: 2025-12-20 15:30:00
# Total networks: 42
8.8.4.0/24
8.8.8.0/24
8.15.202.0/24
...
The tool uses a combination of ARIN's APIs:
- RDAP API for organization search:
https://rdap.arin.net/registry/entities?fn=<name> - REST API for network retrieval:
https://whois.arin.net/rest/org/<handle>/netsor/rest/customer/<handle>/nets
The REST API is more reliable for large organizations as it provides a complete list of all network allocations, whereas RDAP only embeds a subset in the entity response.
Multiple Entity Handling: When searching by name, multiple entities may match (e.g., subsidiaries or related organizations). The tool automatically:
- Finds all matching entities
- Fetches networks from each entity
- Removes duplicates
- Aggregates all networks together
Rate Limiting: The tool implements respectful rate limiting:
- 0.5 second delay between individual network fetches
- 2 second delay between processing different entities
- Automatic retry with exponential backoff for errors
- Connection error handling with retry logic
No API key required for read-only operations.
The tool implements an intelligent "walk up the tree" algorithm:
-
Initial Collapse: Uses Python's
ipaddress.collapse_addresses()to merge overlapping and directly adjacent networks -
Sibling Detection: Iteratively checks if pairs of networks are siblings (can be combined into a larger block):
- For example,
192.168.0.0/24and192.168.1.0/24are siblings - They combine into parent block
192.168.0.0/23
- For example,
-
Iterative Aggregation: Repeats until no more networks can be combined
This ensures you get the minimal set of largest possible CIDR blocks, which is ideal for static routing tables.
Input networks:
10.0.0.0/24
10.0.1.0/24
10.0.2.0/24
10.0.3.0/24
After aggregation:
10.0.0.0/22 (all 4 networks combined)
whois-netblock-scanner/
├── README.md
├── requirements.txt
├── .gitignore
└── whois_scanner/
├── __init__.py
├── __main__.py # Module entry point
├── cli.py # Command-line interface
├── arin_client.py # ARIN RDAP API client
└── subnet_aggregator.py # Network aggregation logic
The tool handles common issues gracefully:
- Organization not found: Provides suggestions for refining search
- Multiple matches: Uses the first match (more control coming in future versions)
- API rate limiting: Automatically retries with exponential backoff
- Network timeouts: Retries up to 3 times
- No networks found: Exits cleanly with informative message
- Python 3.7 or higher
requestslibrary (for HTTP requests)- Standard library modules:
ipaddress,argparse,datetime
This tool is perfect for:
- Generating static routing tables for specific organizations
- Network security analysis and monitoring
- IP address space research
- Firewall rule creation
- Network topology documentation
- IPv4 only: Does not currently support IPv6 networks
- ARIN only: Only queries ARIN database (North America region)
- Rate limiting: For organizations with many networks, the tool may take time due to respectful API rate limiting
- Multiple entities: Organizations with many subsidiaries may match multiple entities; use
--max-entitiesto limit processing
- Check spelling and try variations of the organization name
- Try a shorter or more general name (e.g., "Google" instead of "Google LLC")
- Visit ARIN WHOIS to search manually
- Check your internet connection
- The tool will automatically retry up to 3 times
- ARIN's API may occasionally be under heavy load
- The tool automatically handles rate limiting with delays
- For large organizations (like Comcast), expect the scan to take several minutes
- Use
--max-entities 5to limit processing to just the first few entities for testing - Connection errors are automatically retried with exponential backoff
- If you continue to see connection resets, try running again later when the API is less busy
This tool is provided as-is for legitimate network administration and research purposes.
Contributions are welcome! Future enhancements could include:
- IPv6 support
- Support for other RIRs (RIPE, APNIC, etc.)
- Interactive mode for multiple organization matches
- JSON output format
- Caching of API responses