asnlog

A Go utility that analyzes a NCSA combined web server log (as generated by Apache) and groups accessing IPs by ASN (Autonomous System Number).

I needed a tool like this to better identify bots hammering my server. Ironically this tool is nearly 100% vibe coded.

Usage

Basic Usage

# Analyze a log file (sorted by request count)
./asnlog access.log

# Sort by number of unique IPs
./asnlog -sort ips access.log

# Sort by requests per second
./asnlog -sort reqps access.log

# Hide the (top 5) IP details that are normally shown for each ASN
./asnlog -noips access.log

Command-Line Options

• -sort <method> - Sort output by:
  • requests (default) - Total request count
  • ips - Number of unique IPs
  • reqps - Average requests per second
• -noips - Disable displaying top 5 IPs for each ASN

Note that request per second calculation might be wonky. I somehow expected it to be more useful than it is.

Acknowledgments

• ASN database provided by iptoasn.com
• DNS fallback uses Team Cymru's IP-to-ASN service