nitefood/asn: BGP and IP Recon for Analysts

How to use nitefood/asn for ASN lookups, RPKI validation, BGP path analysis, and IP reputation checks in offensive and defensive workflows.

OSINT Tool Deep-Dives

For: Security professionals, Enthusiasts & students

nitefood/asn: BGP and IP Recon for Analysts

Most IP triage workflows look like this: open a browser tab for WHOIS, another for BGP routing data, a third for RPKI validation, a fourth for threat intel. By the time you’ve cross-referenced all four, you’ve lost five minutes and your browser history looks like a routing textbook. nitefood/asn collapses that into one command.

The tool is a single Bash script, nearly 2,000 GitHub stars at time of writing, and it pulls from routing registries, reputation feeds, and BGP data sources simultaneously. ASN and prefix data, RPKI validity, IP reputation aggregation, geolocation, traceroute with per-hop ASN annotation, redirect-chain resolution for URLs. All of it, one terminal window.

This post covers what it does, where it fits against the alternatives, and a step-by-step workflow you can run right now.

What the Tool Actually Does

asn wraps lookups across several external sources. Per the project’s own README (the authoritative reference for flags and API configuration), the core capabilities are:

• ASN and organization lookup for IPs and domains
• BGP prefix and AS-path data
• RPKI validity checking — valid, invalid, or not covered by a Route Origin Authorization
• Full IPv4 and IPv6 support
• IP reputation aggregation from multiple public feeds
• Geolocation to country, region, and city level
• URL resolution following redirect chains, with enrichment applied at each hop
• Annotated traceroute showing which autonomous systems traffic crosses
• Optional self-hosted web server mode for browser-rendered traceroutes
• Optional local API server mode for tool integration

The Perl dependency unlocks some features; the README covers what’s optional versus required. Most core functionality works without it.

Where It Fits

asn answers one question well: what is the network context around this indicator? It is not a vulnerability scanner, not a packet capture tool, not a full threat intelligence platform. It handles the routing and attribution layer.

For red teamers and penetration testers, the main use is reconnaissance. Mapping a target organization’s ASN exposes the full prefix space they announce, which regularly turns up forgotten subnets, cloud egress ranges, and co-hosted infrastructure that never surfaces in DNS enumeration. This maps to MITRE ATT&CK T1590, Gather Victim Network Information.

For SOC analysts and threat hunters, it accelerates triage. An unknown external IP in an alert gets an owning organization, BGP prefix, RPKI status, and reputation summary in one command instead of four separate lookups.

The RPKI check is worth calling out specifically. BGP hijacking is an active threat; an RPKI-invalid prefix on a suspicious route announcement warrants a second look. Integrating that check into a CLI workflow instead of a separate web form matters when you’re running through a queue of indicators.

How It Compares

Team Cymru’s IP-to-ASN service is the right choice for bulk log enrichment pipelines — it operates over whois port 43 with minimal dependencies and handles volume well. It returns no reputation or RPKI data. Shodan’s CLI is excellent for banner grabbing and service discovery, weak on routing context. BGPView’s API covers routing topology but is web-only with no reputation layer.

asn is the only option in that list combining all four concerns in a terminal workflow. The trade-off is external service dependencies. In air-gapped or restricted-egress environments you’ll get partial output. Team Cymru whois will outperform it there.

Installation

The official one-liner for Linux and macOS:

curl -fsSL https://raw.githubusercontent.com/nitefood/asn/master/asn > /usr/local/bin/asn && chmod +x /usr/local/bin/asn

On first run, the script checks for required system utilities (whois, curl, jq, mtr, and others) and tells you what’s missing. On Debian/Ubuntu, one apt install line typically covers all dependencies.

Optional API keys for services including ipqualityscore and Shodan go in ~/.config/asn/asn.conf. The tool runs without them; reputation data is thinner.

A Reproducible Investigation Workflow

The following takes a suspicious IP through a full network context investigation. Swap in any indicator you’re currently working.

Basic IP Lookup

asn 198.51.100.42

Returns ASN, organization name, country, BGP prefix, RPKI validity, and a reputation summary. Check the RPKI field first. An INVALID status in a defensive context warrants escalation, though see the caveats below before blocking.

Organization-Wide Prefix Enumeration

asn -o "Target Organization Name"

Queries routing registries for every prefix the organization’s ASNs announce. For red teamers, this is where you find subsidiary IP ranges that DNS enumeration misses entirely. For asset discovery on your own organization, it’s a fast sanity check on what you’re actually exposing to the internet.

BGP Path Analysis

asn -a AS15169

Returns upstream and downstream BGP peers, the AS-path to reach the target AS, and prefix counts. Comparing announced AS-paths against historical data from BGPStream can surface route hijacking or unexpected transit relationships during incident response.

URL Infrastructure Tracing

asn https://suspicious-domain.example.com

Follows redirect chains, resolves final destination IPs, and applies full enrichment at each hop. In phishing investigations, the landing page IP is usually what matters, not the initial link. This gets you there directly.

Annotated Traceroute

asn -t 198.51.100.42

Runs a traceroute and tags each hop with ASN and organization. The result shows which autonomous systems traffic crosses to reach the target, which matters when you’re checking whether traffic routes through unexpected jurisdictions or known-bad transit providers. The web server mode (asn --server) renders the same data in a browser with visual hop-by-hop mapping if you need something easier to share.

Caveats Worth Knowing

Geolocation accuracy is limited by the underlying databases, and this is a universal problem across IP geolocation tooling, not specific to asn. Treat country-level data as a signal. VPN endpoints, Tor exits, and anycast addresses will be wrong.

RPKI-invalid does not mean malicious. Misconfiguration is common. The flag should prompt investigation, not automatic blocking, unless your policy explicitly specifies otherwise. RIPE NCC’s RPKI documentation is worth reading for calibrating your response threshold.

A clean reputation score is not clearance. New infrastructure may not appear in public threat feeds for days or weeks. Cross-reference with internal telemetry before concluding anything.

Rate limits apply on several external APIs. For bulk enrichment of large IP lists, add delays between calls or use the tool’s API server mode to build a local caching layer.

Integration Patterns

SIEM enrichment. Wrap asn calls in a shell script that accepts IP lists from log exports, outputs JSON, and pipes into Elasticsearch or Splunk. The API server mode is cleaner for high-volume use.

Campaign tracking. Use the -o organization flag during threat actor infrastructure tracking. If you’ve identified an actor’s ASN, you can monitor it for new prefix announcements as they rotate infrastructure.

Red team op-sec. Before standing up C2 infrastructure, run your hosting provider’s ASN through asn to check RPKI validity and whether your intended IP range is already flagged in reputation feeds.

Phishing triage automation. Feed reported phishing URLs into the URL resolution mode as part of a SOC playbook. Every reported URL gets an infrastructure enrichment report without analyst manual intervention.

The project’s GitHub README covers the full flag reference and API integration options. The workflow above is a starting point; the depth is there if you need it.