[anti-abuse-wg] RIPE Autonomous System Numbers

Dear Ronald,

I will try to answer some of your questions. Others may correct me if
I am wrong.

>> I've raised this with the NCC and asked them to prepare an answer to
>> these questions as I feel they fall within their purview.
>>
>> Hopefully they will be able to get back to you soon.
>>
>> Brian
>> Ronald F. Guilmette wrote, On 01/11/2014 03:52:
>>> A few questions, if you don't mind...
>>>
>>> Given some arbitrary record which is stored within the RIPE WHOIS
>>> data base, such as an organization (ORG-*) record or a record for
>>> a number resource, such as an AS, how can I determine the date on
>>> which that record was created?  Do I just look for the earliest
>>> date found in any of the associated changed: fields?
>
> Just to make sure I'm clear... No one on this list knows the answer,
> even to the above trivial question?

I guess there is no good answer to this. As far as I can tell, you have no
means to find out when an object was first added to the database
(i.e. created). The earliest changed: field usually gives you only an upper
limit (i.e the object is most probably not younger than that date).

You can also look at the historical data of the object, see
https://labs.ripe.net/Members/kranjbar/proposal-to-display-history-of-objects-in-ripe-database
however, this does not necessarily help either.

As far as I know, the RIPE NCC, however, in a given case, could tell you
exactly when the given object was created.

There are, however, plans to introduce new attributes (created: and last-modified:)
that would replace the (rather useless) changed: attribute.

>>> Give an AS number, issued within the RIPE region, how can I find
>>> the identity of the associated LIR?  Is the identity of the
>>> associated LIR provided by the sponsoring-org: field of the
>>> WHOIS record for the AS?
>
> Same again.  I am rather astonished that not a single person within
> a group focused on dealing with network abuse issues within the RIPE
> region can even say how to find the LIR that issued a given AS.

This is probably due to the fact that there is no such data available
in the database. You can make some assumptions, but these may be wrong
in some cases. The sponsoring-org: is probably not what you are looking
for, as it only says which LIR is currently taking care of this resource.

A question comes to my mind, however, why do you care about who issued a given
AS? I would think that from an abuse point of view who _uses_ the AS
is much more relevant.

I hope this helps.

>  Does
> no one, other than me, ever even get curious about such things?

This is not necessarily the case. However, as I pointed out, there are
some data that at present cannot be retrieved form the database.

Best regards,
Janos


>>> What sorts of credentials or bona fides must or should applicants
>>> who are requesting AS number allocations provide to the RIPE LIR
>>> which processes the request(s)?
>
> Same comments as above.
>
>>> Has any AS number allocation, issued within the RIPE region, ever
>>> been revoked without the consent of the registrant of that allocation?
>>> If so, which ones?  And in those cases, what policies and/or procedures
>>> were used or followed during the revocation process?  Are these
>>> policies and/or procedures written down someplace, or are they entirely
>>> ad hoc?
>
> Someone did write to me, off-list, with a semi-response to the above,
> informing me that ``details'' of RIPE investigations are non-public.
> I should probably have clarified that I wasn't asking for any specific
> details about any specific case.  I asked, in the first instance, if any
> AS allocation had ever been revoked.  That's a yes/no question, and one
> which I thought would have been easy to answer, particularly by members
> of a group focused on network abuse issues.
>
> But if all of these questions can only be answered by the NCC, then I
> guess that's the way it is, and I thank you for forwarding my queries to
> them.
>
>