[anti-abuse-wg] Draft Anti-Abuse Working Group Minutes - RIPE 60

On 9 Aug 2010, at 4:19, Richard Cox wrote:

[...]

> What is worth bearing in mind is that a revoked allocation should show
> up in IP-WHOIS as REVOKED for a given period of time after revocation.
> Otherwise we get the vexing situation where an abuser asks an ISP to
> route his IP block and tells the ISP, when they check RIPE's WHOIS and
> see "not found", "Oh dear, looks like the RIPE database isn't working.
> 
> "Revoked" must be clearly visible.

I disagree. I do not think the registry should publish a comment on why a registration exists or does not exist and the word REVOKED is clearly intended to imply that the registration was removed against the desires of the registrant. Publishing a registration (a positive act) but giving it a negative status is likely to cause confusion, especially with automated network-centric systems that ignore the status attribute value.

I also think the example you give is unrealistic. If the ISP can see its own object and a bunch of other objects then the problem is unlikely to be that to be that the whois database is broken. And if they were genuinely concerned about a problem with the database they could always contact the RIPE NCC.

If some kind of mechanism is needed to allow network operators to check that a prefix is not currently registered, then we should ask the RIPE NCC to publish an easy to parse list of prefixes and the date on which they were removed from the database. Presumably a prefix would remain on the list until it had completed any quarantine period and is ready to be re-issued.

Regards,

Leo Vegoda