7

I was editing an IT Security stack exchange question to add geolocation information to a Tor question and I noticed that one of the 10 hard coded directory authorities is ambiguous about its location:

Is Faravahar of ./src/or/config.c at Line 859 hosted in Mauritius as implied by Tor whois or in Washington D.C. as implied by standard geolocation services?

This could of course just be the usual differences between the location of a NIC registrar and an actual server; but then why is Faravahar (154.35.32.5) the only hard coded node using a registrar not of the node's hosting country? I'm curious.

9

This netblock was owned by PSINet, one of the first and early ISPs. PSINet was purchased by Cogent many years ago, and thus Cogent became the owner of the netblock (154.35.0.0/16). At some point IANA, or ARIN, or AfriNIC, or all of the above decided that the supernet to which 154.35.0.0/16 belongs, 154.0.0.0/8, was allocated to Africa. You can see that switch here:

Now just because IANA decides to reallocate a /8 doesn't mean everyone in that /8 loses their IP space. That would be disastrous to all involved, obviously. So Cogent maintains ownership of 154.35.0.0/16, while IP space around them is allocated to African providers. Unless Cogent decides to return 154.35.0.0/16, it will also be so.

So why does 154.0.0.0/8, and 154.35.0.0/16, show up in Mauritius?

This is because the address of AfriNIC is in Mauritius:

OrgName: African Network Information Center
OrgId: AFRINIC
Address: Level 11ABC
Address: Raffles Tower
Address: Lot 19, Cybercity
City: Ebene
StateProv:
PostalCode:
Country: MU

This is the default setting for all IP space allocated to AfriNIC (Africa). It remains the setting until the IP space is allocated to an African provider, at which point the whois is updated to reflect the provider's address. Since 154.35.0.0/16 isn't and won't be allocated to an African provider, the address remains the address of AfriNIC.

4

I would say that 154.35.32.5 is located in the US, most probably DC area.

Let's look at whois 154.35.32.5:

% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '154.35.0.0 - 154.35.255.255'

inetnum:        154.35.0.0 - 154.35.255.255
netname:        NET-154-35-0-0
descr:          __________________________
descr:          This block is allocated to an organization in the ARIN
descr:          region. Please query whois.arin.net for more
descr:          information on the registrant.
descr:          __________________________
country:        MU
org:            ORG-AFNC1-AFRINIC
admin-c:        TEAM-AFRINIC
tech-c:         TEAM-AFRINIC
status:         ALLOCATED UNSPECIFIED
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered
parent:         154.0.0.0 - 154.255.255.255

country: MU is where the Tor whois get their location from. While usually correct, this specific /16 seems to have been sold (see the descr lines).

You can see further info when calling whois --host whois.arin.net 154.35.32.5 as suggested in the whois above, which yields that this /16 has been sold to PSINet, Inc. in DC.:

NetRange:       154.35.0.0 - 154.35.255.255
CIDR:           154.35.0.0/16
OriginAS:       AS174
NetName:        COGENT-154-35-16
NetHandle:      NET-154-35-0-0-1
Parent:         NET-154-0-0-0-0
NetType:        Direct Assignment
RegDate:        1992-02-05
Updated:        2011-05-27
Ref:            http://whois.arin.net/rest/net/NET-154-35-0-0-1

OrgName:        PSINet, Inc.
OrgId:          PSI-2
Address:        1015 31st St NW
City:           Washington
StateProv:      DC
PostalCode:     20007
Country:        US
RegDate:        1990-10-08
Updated:        2009-01-26
Ref:            http://whois.arin.net/rest/org/PSI-2

As the Tor whois does not do this step of recursion, it displays Mauritius and confuses you.

3
  • Do you know why Faravahar is using a registrar not of its hosting country? It does give the false impression that jurisdictional risk is spread over an extra country. Oct 5 '13 at 22:35
  • Traceroute indicates it's in the Chicago area. Oct 9 '13 at 3:18
  • @LateralFractal: I guess there is no intention in that. See SiNA Rabbanis answer for details of the IP-space move.
    – zhenech
    Oct 9 '13 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.