-2

I have some idea. But my small knowledge of bash, does not give me the desired result. Look. I use nslookup command for get the ip of site. 

nslookup facebook.com

Server:         xxx.xxx.xxx.xxx
Address:        xxx.xxx.xxx.xxx#53

Non-authoritative answer:
Name:   facebook.com
Address: 69.171.230.68

Next step, that take value "origin".

whois -h whois.radb.net 69.171.230.68

[Querying whois.radb.net]
[whois.radb.net]
route:      69.171.224.0/20
descr:      Facebook, Inc
origin:     AS32934
mnt-by:     MAINT-AS32934
changed:    jj@fb.com 20110530  #01:29:45Z
source:     RADB

You can see, origin: AS32934

And next step, it is list of site networks:

whois -h whois.radb.net '!gAS32934' | grep /

204.15.20.0/22 69.63.176.0/20 66.220.144.0/20 66.220.144.0/21 69.63.184.0/21 69.63.176.0/21 74.119.76.0/22 69.171.255.0/24 173.252.64.0/18 69.171.224.0/19 69.171.224.0/20 103.4.96.0/22 69.63.176.0/24 173.252.64.0/19 173.252.70.0/24 31.13.64.0/18 31.13.24.0/21 66.220.152.0/21 66.220.159.0/24 69.171.239.0/24 69.171.240.0/20 31.13.64.0/19 31.13.64.0/24 31.13.65.0/24 31.13.67.0/24 31.13.68.0/24 31.13.69.0/24 31.13.70.0/24 31.13.71.0/24 31.13.72.0/24 31.13.73.0/24 31.13.74.0/24 31.13.75.0/24 31.13.76.0/24 31.13.77.0/24 31.13.96.0/19 31.13.66.0/24 173.252.96.0/19 69.63.178.0/24 31.13.78.0/24 31.13.79.0/24 31.13.80.0/24 31.13.82.0/24 31.13.83.0/24 31.13.84.0/24 31.13.85.0/24 31.13.86.0/24 31.13.87.0/24 31.13.88.0/24 31.13.89.0/24 31.13.90.0/24 31.13.91.0/24 31.13.92.0/24 31.13.93.0/24 31.13.94.0/24 31.13.95.0/24 69.171.253.0/24 69.63.186.0/24 31.13.81.0/24 179.60.192.0/22 179.60.192.0/24 179.60.193.0/24 179.60.194.0/24 179.60.195.0/24 185.60.216.0/22 45.64.40.0/22 185.60.216.0/24 185.60.217.0/24 185.60.218.0/24 185.60.219.0/24 129.134.0.0/16 157.240.0.0/16 204.15.20.0/22 69.63.176.0/20 69.63.176.0/21 69.63.184.0/21 66.220.144.0/20 69.63.176.0/20

Finally, we drop all destinations ip. I want make that process automatically. But, how to parse that value "origin" ? I need to use it in my iptables firewall.

Valeriu
  • 171
  • 1
  • 1
  • 11

1 Answers1

1

You can do this with shell scripts. First of all, to get the network address use awk to filter the nslookup output, printing the second token on the Address: line. Note that there is more than one address line, so use tail to pick the last one only. The $() construct is used to put the result into the $address variable.

address=$(nslookup facebook.com | awk '/Address:/ {print $2}' | tail -1)

Similarly use $address as a parameter to whois and filter the output again.

origin=$(whois -h whois.radb.net $address | awk '/origin:/ {print $2}')
Neil Masson
  • 2,609
  • 1
  • 15
  • 23
  • origin=$(whois -h whois.radb.net $address | awk '/Registrant Phone:/ {print $2}') i have tried above command but not work – Hardik Gajjar Nov 16 '16 at 06:33