Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
aalex954 authored Apr 26, 2023
1 parent a9cdc1d commit 9fbd77a
Showing 1 changed file with 27 additions and 11 deletions.
38 changes: 27 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,37 +2,49 @@

[![Publish MSFT ASN IP Ranges](https://github.com/aalex954/MSFT-IP-Tracker/actions/workflows/build_and_release.yml/badge.svg?branch=master)](https://github.com/aalex954/MSFT-IP-Tracker/actions/workflows/build_and_release.yml)

Tracking ASNs using data from stat.ripe.net

```3598,5761,6182,6584,8068,8069,8070,8071,8075```

```12076,13399,14271,14719,20046,23468,35106,45139,52985,395496,395524,395851,396463,398575,398656,400572```
---

## Description

A tool to track Microsoft IPs for use in security research, firewall configuration, routing, and troubleshooting.

- Tracks a range of ASNs and publishes a daily release containing a list of IPv4 and IPv6 address in CIDR notation.
- Release updated daily at 12 AM UTC / 7 PM EST.

Note:
_Note_

Microsoft does report their own IP ranges and associated roles, which can be referenced here:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7
- https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

- https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7


This tool just double checks 😉

---

### Tracking ```32``` ASNs using data from : ```stat.ripe.net```

```3598,5761,6182,6584,8068,8069,8070,8071,8075,12076,13399,14271```

```14719,20046,23468,25796,30135,30575,32476,35106,36006,45139,52985```

```63314,395496,395524,395851,396463,397466,398575,398656,400572```

---

## Limitations

### Is it guaranteed that all IP addresses within an AS prefix belong to the assigned AS?

No, IP addresses within an AS prefix are not guaranteed to be owned by the AS that the prefix is assigned to.

The assignment of an AS prefix to a network operator does not necessarily mean that all IP addresses within that prefix are owned or used by that network operator.
> The assignment of an AS prefix to a network operator does not necessarily mean that all IP addresses within that prefix are owned or used by that network operator.
In many cases, an AS prefix may be further divided into smaller sub-prefixes or IP address ranges that are assigned or leased to other organizations, which may be different from the original AS owner.
Additionally, IP address ownership can change over time, and some IP addresses within an AS prefix may be transferred to other entities or may become unassigned.


### Can using AS prefixes to identify traffic from a specific company?

Yes, BUT..
Expand All @@ -48,15 +60,19 @@ While using AS prefixes to identify traffic from a specific company can be usefu
- It's also possible for malicious actors to spoof their IP address to make it appear as though their request is coming from a trusted AS prefix (ex. azure vm).
- ✅ Maintenance:
- AS prefixes are subject to change over time, and a company's network may be reassigned to a different AS number or IP address range.

---

## Usage

The most up to date list can be accessed via the daily releases.

https://github.com/aalex954/MSFT-IP-Tracker/releases
- https://github.com/aalex954/MSFT-IP-Tracker/releases

### Direct download:

```wget https://github.com/aalex954/MSFT-IP-Tracker/releases/latest/download/msft_asn_ip_ranges.txt```
- [msft_asn_ip_ranges.txt](https://github.com/aalex954/MSFT-IP-Tracker/releases/latest/download/msft_asn_ip_ranges.txt)

- ```wget https://github.com/aalex954/MSFT-IP-Tracker/releases/latest/download/msft_asn_ip_ranges.txt```

---

0 comments on commit 9fbd77a

Please sign in to comment.