Lightly used IP addresses

Mailman List Mirror (Read Only)
21

Is this upstream going to cut that customer off and

  >> lose the revenue, just to satisfy ARIN's bleating?
  >
  >Isn't this a little bit like an SSL daemon? One which refuses to process a revocation list on the basis of the function of the certificate is useless. The revocation list only has authority if the agent asks for and processes it. Would you use this SSL daemon, knowing that it had this bug?
  >
  >I would consider a transit provider who subverted an ARIN revocation to be disreputable, and seek other sources of transit.

Assuming the public even found out about the situation.

For ARIN to make good on this community goodwill, they'd have to

(1) publish the disrepute of the upstream who refuses to stop announcing the rogue
downstream's prefixes.

Im not sure what step 2+ is going to be there, but I bet ARIN would become very
unpopular with (1) above amongst its customers reselling bandwidth to other ARIN
IPv4 block users.

How many large carriers on this list would immediately halt announcing a
downstream-in-good-financial-standing's prefixes just because ARIN say's they're
delinquent?

I bet most wont even answer this question to the list here - most likely dont
have an official policy for this situation, and if they did, it's likely not
going to be publically disclosed.

(If any are willing to disclose such publically, I'd love to hear/see the policy's
details.)

/kc

22

Ken -

  ARIN maintains the WHOIS based on what the community develops for
  policies; what's happens in routing tables is entirely up to the
  ISP community. No "bleating" or "large sticks" here, just turning
  the policy crank and managing address space accordingly.

  ARIN pulls the address space, and then (after holddown) reissues it
  to another provider. WHOIS reflects this change, as does in-addr.
  Whether an ISP respect the information in WHOIS is likely to always
  be a "local decision"; ARIN's responsibility is to make sure that
  the information contained therein matches the community's policy
  not some hypothetical routing enforcement.

  There will be an ISP attempting to make use of that reassigned
  address space, and one could imagine that party being let down
  if the community says one thing in policy but does another when
  it comes to routing.

/John

John Curran
President and CEO
ARIN

23

I've tried to deal with that a few times - mainly by writing up the first upstream AS. Usually they don't care (and every time I have noticed someone blatantly stealing space, it's been spammers).

Good filtering at the transit provider border IMNSHO is the best way to solve this problem.

Leslie

24

Thanks John - I realise this.

I was merely putting on the hat of those who may try to bend the policies to
their advantage through delinquent activity. The common good is at stake here,
and I'd rather that ARIN did have some collective 'stick' to effectively apply
itself or via its members. I too don't want to deal with announcements for
the same prefix from multiple warring AS's or other side effects of the IPv4
crunch.

I'm indicating (the probably obvious) that these pressures will certainly
increase over time, and as one other member pointed out, the sticks may become
neccessary - and the community will have to become more 'constitutionally
ethical' in their handling of delinquents on ARIN's/the commmunity's behalf.

Not sure what incentives are in play to encourage this, as it will become necessary
in a shorter time than we may think.

Thanks for your reply and clarifications.

/kc

25

  If someone who was downstream from this provider in a similar situation, I'd
say there is a stronger propensity for them to not 'do the right thing'. which by
the way isn't a law, so who says its right? its a set of guide lines a group of
folks put together.

But the reality is that you asserted your intention to follow those guidelines when you requested the allocation, did you not?

If an upstream accepts announcements from a revoked block, what is to stop them from accepting announcements for an unallocated block? I realize this precariously borders on committing a slippery slope fallacy, but I think it's a valid question to ask - a provider is either 'in compliance' with the guidelines, or 'not in compliance' with them. Once you're 'not in compliance' a little bit, how can I have a valid trust relationship with you about the rest of it?

see previous note about SSL being worthless for identity assurance.

Fair enough - serves me right for invoking analogy.

following a corporation (yes, ARIN is a corporation) as if you were a sheep will
empower them to do precisely this in the future.

There's no sheepism here. The proposed situation represents a valid reason for revoking address space under the community developed guidelines. I don't see the problem with following those guidelines, do you?

How many large carriers on this list would immediately halt announcing a
downstream-in-good-financial-standing's prefixes just because ARIN say's
they're delinquent?

That depends. I vote with my wallet. How many carriers want my business, and the business of other customers who (reasonably) expect compliance with the standing policies? Do you want to do business with someone who's willing to break the rules everyone else is playing by?

Best Regards,
Nathan Eisenberg
Atlas Networks, LLC

26

Bill -

  We'll work on generating these numbers to the extent
  possible for the upcoming meeting; back in April, I noted
  that we had about 21% of the legacy space (by total IP
  address count) under an LRSA (6%) or RSA (15%). For now,
  this is first order estimate for your second and third
  questions. These numbers keep going up, so we'll need
  some work to generate current ones for the next meeting.
  Regarding the last one, that's very difficult to obtain;
  how do you see it impacting the overall outcome?

/John

John Curran
President and CEO
ARIN

27

This already happens as we speak with "IP brokers".

~Seth

28

But the reality is that you asserted your intention to follow those

  guidelines when you requested the allocation, did you not?

  >If an upstream accepts announcements from a revoked block, what is to stop
  them from accepting announcements for an unallocated block? I realize this
  precariously borders on committing a slippery slope fallacy, but I think
  it's a valid question to ask - a provider is either 'in compliance' with the
  guidelines, or 'not in compliance' with them. Once you're 'not in
  compliance' a little bit, how can I have a valid trust relationship with you
  about the rest of it?

There's a difference - once the upstream is hooked on the revenue stream they're not
going to want to interfere with it. They might pass along some threats from ARIN
and/or levy their own, but I doubt they'd seriously make good on it and cut their
own hand off and lose the revenue.

That's for a deallocated block that was in good standing originally - this
assumes the contract for transit with the upstream included someone there
ensuring that the block was properly/legally allocated, and
WHOIS/RADB/Swip/yadda and everything else was properly notated and setup.
Going from good standing with a revenue stream for some months/years to bad is
different from accepting a bogon customer at the very start of the
arrangement. Lots of things would not lineup with a minimum of due dilligence,
and I suspect that most providers with any ethical slant will refuse to
provide service (scenario screams 'SPAMMER!' for one). That's alot different
from shutting off a revenue stream that was working well (sans spam) for
a year or more prior.

  >> following a corporation (yes, ARIN is a corporation) as if you were a sheep will
  >> empower them to do precisely this in the future.
  >
  >There's no sheepism here. The proposed situation represents a valid reason
  for revoking address space under the community developed guidelines. I
  don't see the problem with following those guidelines, do you?

The reality is that following the guidelines is psychologically difficult in
harder times as we're experiencing now. Without any real repercussions for the
upstream for NOT cutting off the customer, balanced against the existing
revenue stream from the delinquent (assuming they're not delinquent with their
transit provider as well), it's not a hard calculation. I dont see much
'community' fallout occurring either, or we'd see it on this list. A few
transit providers have very poor reputations in the community (y'all know who
they are), and personally I won't purchase from them, but certainly none of
them have garnered this reputation by not cutting off ARIN delinquents. It's
just not publically available data - I dont think ARIN publishes this as I said,
and if they did I suspect it'd be a pretty busy-yet-boring mailing list (with
alot of screaming and name calling if it was open to public posting :).

  >> How many large carriers on this list would immediately halt announcing a
  >> downstream-in-good-financial-standing's prefixes just because ARIN say's
  >> they're delinquent?

  >That depends. I vote with my wallet. How many carriers want my business,
  and the business of other customers who (reasonably) expect compliance with
  the standing policies? Do you want to do business with someone who's
  willing to break the rules everyone else is playing by?

IS everyone else playing by them? We dont really have data as I mentioned, or
I don't at least, so if anyone can provide stats (ARIN? some bulk numbers
without naming any names?) that'd be helpful in shaping this dicussion by
identifying how large the issue really is. Number of requests to upstreams to
halt announcements, and a mean and stddev on days-til-compliance for that
action (or how many delinquents were succesfully scared into paying ARIN by an
upstream's sternly worded warning would also be interesting). Unfortunately
such stats would also be good hard data for gamblers to model the risk/reward
profile on continuing to not pay. :slight_smile: Shades of freakonomics game theory here...

  >Best Regards,
  >Nathan Eisenberg
  >Atlas Networks, LLC

/kc

29

How long did it take to cut Intercage off for *lots* worse things?

30

1. B applies for a block of IPv4 addresses from ARIN.

2. ARIN says: "You qualify for a /20. You have been added to the
waiting list. You may also receive a transfer."

3. B finds A offering to sell a /20 on ebay or wherever.

4. A sells a /20 of IPv4 space to B for, say, $5,000

5. A tells ARIN to transfer the chunk to B

6. ARIN tells B: "A has authorized the transfer of x.y.z.0/20 to you.
You previously qualified for a /20. Pay your registration fee at
http://website to complete the transfer."

7. You pay. The /20 is transferred.

It remains to be seen if / how well this works. But that's the basic plan.

Regards,
Bill Herrin

31

these questions were asked in response to Owens views on
  the ARIN reclaimation process in the case of documented
  transfers outside the existing ARIN processes.

  my assertion to Owen was that his views would apply directly
  to the folks under a standard RSA. My reading of the
  LRSA suggests that ARIN has a much narrower remit on recovery
  of resources covered by that document. the third camp was/is
  a much thornier patch of ground, fraught w/ peril if ARIN
  takes action on recovery, at least imho. #4, well that sounds
  like fruitful ground for inter-RIR coordination.

  for example, if 75% of the total resource under ARIN administration
  is legacy, then 25% is covered by the standard RSA. Within the 75%,
  6% of it is under LRSA and 15% of it is under the standard RSA.

  if this characterization is in ballpark, then Owens view on
  reclaimation only holds for ~30% of the resource under ARIN administration.

  Correct?

--bill

32

    % of ARIN managed resource covered by standard RSA?
    % of ARIN managed legacy resource covered by legacy RSA?
    % of ARIN managed legacy resource not otherwise covered?
    % of ARIN region entities (A & B above) that have offices/relationships
     with other RIRs that have a divergent transfer process in place?

  We'll work on generating these numbers to the extent
  possible for the upcoming meeting; back in April, I noted
  that we had about 21% of the legacy space (by total IP
  address count) under an LRSA (6%) or RSA (15%). For now,
  this is first order estimate for your second and third
  questions.

% of space and % of holders, please

randy

33

I gave % of space in the April numbers above (the number of
holders at that time was approximately 700 of estimated 18000)

/John

John Curran
President and CEO
ARIN

34

We'll work on generating these numbers to the extent
possible for the upcoming meeting; back in April, I noted
that we had about 21% of the legacy space (by total IP
address count) under an LRSA (6%) or RSA (15%). For now,
this is first order estimate for your second and third
questions.

% of space and % of holders, please

I gave % of space in the April numbers above

i am literate, even at this hour

the number of holders at that time was approximately 700 of estimated
18000

thanks. but i meant when you report at meeting, on web site, whatever.
please report both, not just the one with the larger number.

randy

35

Yes, will do.
/John

36

thanks. but i meant when you report at meeting, on web site, whatever.
please report both, not just the one with the larger number.

Yes, will do.

thanks

randy

37

I know of several large providers that would stop routing such "rogue" space.

Any provider that isn't prepared to deal with such a possible customer threat or problem you don't want to be associating with. They likely harbor other badness as well.

It may take some time to catch up to them but we have seen more of these rogue elements end up with people refusing to sell to them or law enforcement taking some action.

If your management does not realize they are buying from possible criminals, you get what you pay for.

I've found a number of cases where providers are actually doing mitm and stealing SIP credentials for fraud. Make sure you actually have good controls and communication for when things hit the fan....

Jared Mauch

38

I've tried to deal with that a few times - mainly by writing up the
first upstream AS. Usually they don't care (and every time I have
noticed someone blatantly stealing space, it's been spammers).

Has there ever been a case where ARIN has tried to take a block back
from a party to whom they had allocated it and doesn't want to give it
back? My impression is that stolen space is all swamp or legacy or
abandoned, but I really don't know.

In case it's not obvious, I'm not advocating that people thumb their
noses at ARIN, but I don't see any obvious way to avoid my scenario.

R's,
John

39

Make a public example of the situation. Assign such a block to an ARIN
member with extensive legal resources who's willing to send some nasty
letters out, and back it up with court action to establish legal
precedence.

Or ARIN could do so itself on the grounds of breach of contract.

Of course, said block should clearly fall within ARIN's domain, backed up
with a signed contract from the original party.

40

The LRSA provides specific rights which could very likely preclude
reclamation in some circumstances and result in the resources then
remaining as-is with address holder, i.e., this would still prevent
transfer contrary to the community policy but also prevent reissue.
(this occurs in the LRSA under some circumstances recognizing the
history of the legacy address space with the community).

Okay, to try and get some numbers back into the thread: From
Leslie's Registration Services report in Toronto, pages 6 and 9:
<https://www.arin.net/participate/meetings/reports/ARIN_XXV/PDF/Wednesday/Nobile_RSD.pdf>
First, I note that the 700 number I used from memory for number of
organizations was not correct; I gave the total signed, approved,
and pending. The number 444 signed is what corresponds to the 6%
under LRSA. Nicely, the actual numbers are in the report, so we see
6.49 /8 equivalents space under LRSA, out of the total legacy space
of 73 /8 equivalents (page 9). The RSA space is 33 /8 equivalents,
and total inventory is 106 /8 equivalents. (Randy, does this level
of reporting suffice for your purposes?)

So, recasting final numbers back to the original context:

63% (66.5/106) of the address space managed by ARIN is
Legacy-not-under-agreement, and ARIN's action with this space
is governed by the policies adopted by the community. ARIN
clearly could be in a difficult situation if policies adopted
needlessly result in impact to these legacy address holders.

6% (6.5/106) of the address space managed by ARIN is
Legacy-under-LRSA, and has specific contractual language which
may take precedence over community adopted policy (and could
both prevent transfers from completing and reclamation from
occurring).

31% (33/106) of the address space managed by ARIN is per-RSA,
and ARIN's action with this space is clearly governed by the
policies adopted by the community.

/John

John Curran
President and CEO
ARIN