Skip to content

Instantly share code, notes, and snippets.

@jaygooby
Last active April 16, 2023 11:08
Show Gist options
  • Save jaygooby/093cea47ca6e0305d7e138340c37cee6 to your computer and use it in GitHub Desktop.
Save jaygooby/093cea47ca6e0305d7e138340c37cee6 to your computer and use it in GitHub Desktop.
Gets and caches the netblock owner from `whois` for an IP address
#!/bin/bash
#
#
# MIT License
#
# Copyright (c) 2022 Jay Caines-Gooby, @jaygooby, jay@gooby.org
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
#
# Get some basic details on the owner of an IP address
# caches results for faster lookup
#
# e.g.
# $ netblock-from-whois 104.196.165.78
# GOOGLE-CLOUD Google LLC (GOOGL-2)
#
# $ netblock-from-whois 207.46.13.216
# MICROSOFT-GLOBAL-NET Microsoft Corporation (MSFT)
set -eu
# check dependencies
for dependency in date egrep stat whois; do
which $dependency > /dev/null || (echo "You need to have '$dependency' installed and in your \$PATH" >&2 && exit 1)
done
ip=$1
# split the IP address into the four quads
read quad1 quad2 quad3 quad4 <<<"${ip//./ }"
cached_whois_path="$HOME/.whois/$quad1/$quad2/$quad3/$quad4"
cached_whois_record="$cached_whois_path/$ip"
# what was the time in epoch seconds 24 hours ago?
# (try gnu and then bsd for Macos)
hours_24=$(date --date="24 hours ago" +%s 2>/dev/null|| date -v-24H +%s 2>/dev/null)
# ensure we have the cache directory
mkdir -p "$cached_whois_path"
# how old in epoch seconds is the cached record, if it exists?
# (again we need to use gnu and bsd styles to be sure)
age_of_cached_whois_record=$(stat -c %Y -- "$cached_whois_record" 2>/dev/null || stat -f %m "$cached_whois_record" 2>/dev/null || echo 0)
# reads the data from whois or our cache
get_data_from_whois() {
# Do we need to write to or refresh the cache?
if [ ! -f "$cached_whois_record" ] || [ "$hours_24" -gt "$age_of_cached_whois_record" ]; then
# try and rm the file (it might not yet exist)
# echo "caching whois for $ip" >&2
rm -f "$cached_whois_record"
whois $ip > "$cached_whois_record" || echo "whois error for $ip" >&2
fi
cat "$cached_whois_record" | egrep -i "NetName|Organization|organisation|org-name" | cut -d":" -f2 | xargs
}
get_data_from_whois $ip
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment