Many Farsight users access DNSDB API with dnsdbq and dnsdbflex, DNSDB Scout, or one of our various integrations. However, some users may want to try building their own custom interface. This isn’t necessarily hard per se, but often there can seem to be an endless stream of minor stumbling blocks that can still “trip you up” until you work out how to overcome them.
We decided to “eat our own dogfood” and build a sample tabbed graphical user interface in Python3. We call this application “bang_question” because often systems and networks will be running normally when suddenly something “flies in from left field” and “bangs into thing”s (“!”). That may leave you wanting to know “Now what the heck was THAT?” (“?”) The application name seemed to capture that “bang_question” experience perfectly!
The nine tabs in our demo application would accept a fully qualified domain name (FQDN), and then:
- Grab a copy of the specified FQDN’s web site
- Look up the FQDN in DNSDB RRnames
- Check that FQDN’s IP address in DNSDB Rdata
- Retrieve Domain Whois for the domain
- Resolve the IP associated with the FQDN and then get IP Whois for that IP
- Find the ASN originating that IP, and then retrieve ASN Whois for that ASN
- Look up the full set of prefixes announced by that ASN
- Geolocate the IP, and then map that location
- Creating a network graph showing how DNSDB RRnames inter-relate
This ends up looking like:
We explain how that all comes together in a new whitepaper, including providing a copy of our Python3 code so you can see how we put that application together (and so you can build on that code and improve it if you’re interested in doing so).
To grab a copy of the whitepaper, download it here.
A copy of the application code can be downloaded here.
We hope you find this an interesting application, and encourage you to extend and enhance the basic framework we’ve outlined. We welcome your feedback on this whitepaper and code — write [email protected].
Joe St Sauver is a Distinguished Scientist and Director of Research at Farsight Security, Inc..
