Re: ASN in use, but no whois data?

[Bill Woodcock]

> On Feb 26, 2022, at 12:07 AM, Jeroen Massar via NANOG  wrote:
> 
> 
> 
>> On 20220225, at 23:45, Matt Harris  wrote:
>> 
>> Hey folks,
>> I'm looking at an ASN 394183 and I can't find any whois or other contact 
>> data.

Yeah, in the wake of our peering survey, we’ve been looking into this…  A 
surprising number of ASNs responded to the survey, but then we ran into errors 
when we went to geo-code their response to a country using the whois.  There 
are zombie ASes like this in ARIN and in the IANA not-yet-delegated pool, but 
not in the other four RIRs.

-Bill



signature.asc
Description: Message signed with OpenPGP

Re: ASN in use, but no whois data?

[Jeroen Massar via NANOG]

> On 20220225, at 23:45, Matt Harris  wrote:
> 
> Hey folks,
> I'm looking at an ASN 394183 and I can't find any whois or other contact data.

First stop for info: bgp.tools!

https://bgp.tools/as/394183#whois

But yes, as others commented, looks like a ARIN-expired ASN... as long as one 
pay the bills at upstreams your data is safe ;)

Greets,
 Jeroen

Re: ASN in use, but no whois data?

[Suresh Ramasubramanian]

Legacy lookup here


ASHandle:   AS394183
OrgID:  ORCL-2
ASName: OROCKLLC-USA-ASN
ASNumber:   394183
RegDate:2015-07-01
Updated:2015-07-01
Source: ARIN


OrgID:  ORCL-2
OrgName:Orange Rock Consulting, LLC
CanAllocate:
Street: 300 West Glenoaks Blvd., Suite 106
City:   Glendale
State/Prov: CA
Country:US
PostalCode: 91202
RegDate:2014-11-26
Updated:2014-11-26
OrgAbuseHandle: LEONJ4-ARIN
OrgAdminHandle: LEONJ4-ARIN
OrgNOCHandle:   LEONJ4-ARIN
OrgTechHandle:  LEONJ4-ARIN
Source: ARIN


POCHandle:  LEONJ4-ARIN
IsRole: N
LastName:   Leon
FirstName:  John
Street: 300 West Glenoaks Blvd., Suite 106
City:   Glendale
State/Prov: CA
Country:US
PostalCode: 91202
RegDate:2014-11-24
Updated:2020-12-01
MobilePhone:+1-714-782-4326
FaxPhone:   +1-818-484-2010
OfficePhone:+1-800-253-6121
Mailbox:j...@orockllc.com
Source: ARIN


--srs

From: NANOG  on behalf of Phineas 
Walton 
Sent: Saturday, February 26, 2022 4:25:56 AM
To: Matt Harris 
Cc: North American Network Operators' Group 
Subject: Re: ASN in use, but no whois data?

The AS customer could've churned from ARIN, freeing the ASN but leaving 
technically valid IRRs in databases such as RADb (which seems to be where they 
originate): https://i.imgur.com/r5xx7Y6.png

..thus allowing them to continue to announce their routes under that ASN as 
usual, even though technically it doesn't exist in the ARIN WHOIS.

Phin

On Fri, Feb 25, 2022 at 10:47 PM Matt Harris 
mailto:m...@netfire.net>> wrote:
Hey folks,
I'm looking at an ASN 394183 and I can't find any whois or other contact data. 
I've checked globally and then also ARIN directly and literally nothing as if 
it weren't registered. It's announcing prefixes, at least one of which is IRR 
invalid part of a larger old PSINET block, though, and I'm seeing them in the 
global routing table.

Anyone have any idea how this could happen where an ASN is in use, transiting 
several major providers to the internet, but no whois data as if it didn't 
exist?

Thanks,
Matt

[X]
Matt Harris​
|
Infrastructure Lead
816‑256‑5446
|
Direct
Looking for help?
Helpdesk<https://help.netfire.net/>
|
Email Support<mailto:h...@netfire.net>
[https://netfire.net/Flag-United-States-of-America.jpg]
We build customized end‑to‑end technology solutions powered by NetFire Cloud.

Re: ASN in use, but no whois data?

[John Kristoff]

On Fri, 25 Feb 2022 16:45:33 -0600
Matt Harris  wrote:

> I'm looking at an ASN 394183 and I can't find any whois or other
> contact data. I've checked globally and then also ARIN directly and

It appears like it might be https://orocktech.com/ but not clear to me
what happened with the contact data.

John

Re: ASN in use, but no whois data?

[Phineas Walton]

The AS customer could've churned from ARIN, freeing the ASN but leaving
*technically* valid IRRs in databases such as RADb (which seems to be where
they originate): https://i.imgur.com/r5xx7Y6.png

..thus allowing them to continue to announce their routes under that ASN as
usual, even though technically it doesn't exist in the ARIN WHOIS.

Phin

On Fri, Feb 25, 2022 at 10:47 PM Matt Harris  wrote:

> Hey folks,
> I'm looking at an ASN 394183 and I can't find any whois or other contact
> data. I've checked globally and then also ARIN directly and literally
> nothing as if it weren't registered. It's announcing prefixes, at least one
> of which is IRR invalid part of a larger old PSINET block, though, and I'm
> seeing them in the global routing table.
>
> Anyone have any idea how this could happen where an ASN is in use,
> transiting several major providers to the internet, but no whois data as if
> it didn't exist?
>
> Thanks,
> Matt
>
> Matt Harris​
> | Infrastructure Lead
> 816‑256‑5446
> | Direct
> Looking for help?
> *Helpdesk* 
> | *Email Support* 
>
> We build customized end‑to‑end technology solutions powered by NetFire Cloud.
>