Skip to content

Latest commit

 

History

3 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 

Repository files navigation

whois-netblock-scanner

A Python tool that queries ARIN's RDAP API to find all IPv4 network blocks owned by an organization and intelligently aggregates them into the largest possible CIDR blocks. Perfect for generating static routing tables.

Features

  • Search organizations by name in ARIN's database
  • Retrieve all IPv4 network allocations for an organization
  • Intelligent subnet aggregation using "walk up the tree" algorithm
  • Combines adjacent networks into larger CIDR blocks
  • Outputs clean text files with one CIDR per line
  • Handles API rate limiting and errors gracefully

Installation

  1. Clone this repository:
git clone <repository-url>
cd whois-netblock-scanner
  1. Create and activate a virtual environment:
python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
  1. Install dependencies:
pip install -r requirements.txt

Usage

Basic Usage

python -m whois_scanner "Organization Name"

This will:

  1. Search for the organization in ARIN
  2. Retrieve all IPv4 networks
  3. Aggregate them into the largest possible blocks
  4. Save results to {ORG-HANDLE}_networks.txt

Examples

# Search for Google's networks
python -m whois_scanner "Google LLC"

# Search Amazon and specify output file
python -m whois_scanner "Amazon.com, Inc." -o amazon_networks.txt

# Get Microsoft networks without aggregation
python -m whois_scanner "Microsoft Corporation" --no-aggregate

# Verbose output with statistics
python -m whois_scanner "Cloudflare, Inc." -v

Command-Line Options

  • org_name - Organization name to search for (required)
  • -o, --output FILE - Output file path (default: {ORG-HANDLE}_networks.txt)
  • --no-aggregate - Skip aggregation, output all networks as-is
  • -v, --verbose - Show detailed progress and statistics
  • --max-entities N - Limit processing to first N matching entities (useful for organizations with many subsidiaries)

Output Format

The output file contains:

  • Header comments with organization info and timestamp
  • One CIDR block per line
  • Networks sorted by IP address

Example output:

# Networks for: Google LLC (GOGL)
# Generated: 2025-12-20 15:30:00
# Total networks: 42
8.8.4.0/24
8.8.8.0/24
8.15.202.0/24
...

How It Works

ARIN RDAP and REST APIs

The tool uses a combination of ARIN's APIs:

  • RDAP API for organization search: https://rdap.arin.net/registry/entities?fn=<name>
  • REST API for network retrieval: https://whois.arin.net/rest/org/<handle>/nets or /rest/customer/<handle>/nets

The REST API is more reliable for large organizations as it provides a complete list of all network allocations, whereas RDAP only embeds a subset in the entity response.

Multiple Entity Handling: When searching by name, multiple entities may match (e.g., subsidiaries or related organizations). The tool automatically:

  1. Finds all matching entities
  2. Fetches networks from each entity
  3. Removes duplicates
  4. Aggregates all networks together

Rate Limiting: The tool implements respectful rate limiting:

  • 0.5 second delay between individual network fetches
  • 2 second delay between processing different entities
  • Automatic retry with exponential backoff for errors
  • Connection error handling with retry logic

No API key required for read-only operations.

Subnet Aggregation Algorithm

The tool implements an intelligent "walk up the tree" algorithm:

  1. Initial Collapse: Uses Python's ipaddress.collapse_addresses() to merge overlapping and directly adjacent networks

  2. Sibling Detection: Iteratively checks if pairs of networks are siblings (can be combined into a larger block):

    • For example, 192.168.0.0/24 and 192.168.1.0/24 are siblings
    • They combine into parent block 192.168.0.0/23
  3. Iterative Aggregation: Repeats until no more networks can be combined

This ensures you get the minimal set of largest possible CIDR blocks, which is ideal for static routing tables.

Example Aggregation

Input networks:
  10.0.0.0/24
  10.0.1.0/24
  10.0.2.0/24
  10.0.3.0/24

After aggregation:
  10.0.0.0/22  (all 4 networks combined)

Project Structure

whois-netblock-scanner/
├── README.md
├── requirements.txt
├── .gitignore
└── whois_scanner/
    ├── __init__.py
    ├── __main__.py           # Module entry point
    ├── cli.py                # Command-line interface
    ├── arin_client.py        # ARIN RDAP API client
    └── subnet_aggregator.py  # Network aggregation logic

Error Handling

The tool handles common issues gracefully:

  • Organization not found: Provides suggestions for refining search
  • Multiple matches: Uses the first match (more control coming in future versions)
  • API rate limiting: Automatically retries with exponential backoff
  • Network timeouts: Retries up to 3 times
  • No networks found: Exits cleanly with informative message

Requirements

  • Python 3.7 or higher
  • requests library (for HTTP requests)
  • Standard library modules: ipaddress, argparse, datetime

Use Cases

This tool is perfect for:

  • Generating static routing tables for specific organizations
  • Network security analysis and monitoring
  • IP address space research
  • Firewall rule creation
  • Network topology documentation

Limitations

  • IPv4 only: Does not currently support IPv6 networks
  • ARIN only: Only queries ARIN database (North America region)
  • Rate limiting: For organizations with many networks, the tool may take time due to respectful API rate limiting
  • Multiple entities: Organizations with many subsidiaries may match multiple entities; use --max-entities to limit processing

Troubleshooting

"Organization not found" error

  • Check spelling and try variations of the organization name
  • Try a shorter or more general name (e.g., "Google" instead of "Google LLC")
  • Visit ARIN WHOIS to search manually

API timeout or connection errors

  • Check your internet connection
  • The tool will automatically retry up to 3 times
  • ARIN's API may occasionally be under heavy load

Rate limiting

  • The tool automatically handles rate limiting with delays
  • For large organizations (like Comcast), expect the scan to take several minutes
  • Use --max-entities 5 to limit processing to just the first few entities for testing
  • Connection errors are automatically retried with exponential backoff
  • If you continue to see connection resets, try running again later when the API is less busy

License

This tool is provided as-is for legitimate network administration and research purposes.

Contributing

Contributions are welcome! Future enhancements could include:

  • IPv6 support
  • Support for other RIRs (RIPE, APNIC, etc.)
  • Interactive mode for multiple organization matches
  • JSON output format
  • Caching of API responses

About

Tool to find top level subnets owned by an org, ipv4 only

Resources

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages