[anti-abuse-wg] New Abuse Information on RIPE NCC Website

Hi,

On Tue, Jun 18, 2013 at 03:29:23PM +0200, furio ercolessi wrote:
> The number in brackets is the approximate total allocation size of the RIR 
> in units of /8, extracted from http://labs.apnic.net/ipv4/report.html .
> 
> ARIN clearly has a serious problem too, but when the number of 
> problem is normalized with the allocation size we obtain (number
> of problems per /8):
> 
> AFRINIC ..... 0.31
> APNIC ....... 0.35
> ARIN ........ 3.44
> LACNIC ...... 0.50
> RIPENCC ..... 6.27

I'm not sure what good is "normalizing by amount of /8s", as that is 
easily skewed by a few early and large allocations, of which ARIN has
quite a lot.

Normalizing by *number of LIRs* seems to be a much more interesting metric
to see "what percentage of the LIRs under a given RIR umbrella are 
problematic".

I do not have today's membership numbers at hand - last time I collected
the figures (end of 2008), RIPE had 6428 members, ARIN had 3465.  As far
as I have followed the regions, the ratio of growth has been similar, so
roughly, RIPE has about 2 times the amount of LIRs that ARIN has.

Now, with about the same entries in the Spamhaus RBL, distributed to
*twice* the amount of "customers", I think the evil/good ratio in RIPE
land is much better...

> Certainly one could argue that this is not the best possible metrics
> as it reflects the point of view of a single actor, and I am sure one
> could find better metrics.  Yet, the normalized result is a factor 2 worse 
> than ARIN, and more than an order of magnitude worse than APNIC.
> I would doubt that other data could change the RIR order.

It really depends on what you're trying to prove.

Of course there are bad actors in the RIPE region - but there are *many*
actors here, and the percentage of bad actors is actually *lower* by
a factor of 2 than in ARIN land.  (That APNIC has so few entries is 
surprising, but if, for example, all Spam from .cn comes from a single
APNIC member, it just shows that just looking at "how many LIRs in a 
given region are bad?" is not an overly useful metric).

> It may be that this result is simply due to a higher concentration
> of criminals in the RIPE area than in other areas.  

No, it's due to "completely useless math".  There are just many more
actors in the RIPE area, so the same amount of criminals spread over
*twice* the amount of RIR members is not "higher concentration" but
"lower".

The number of "criminals per IP address" is indeed higher, yes.  But
what exactly is the use of that metric, except to show "ARIN has a 
larger share from the hoard of /8s"?

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 306 bytes
Desc: not available
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20130618/6f82a5cf/attachment.sig>