[anti-abuse-wg] [db-wg] Solving the issue of rogue ROUTE objects in the RIPE Database

On Sat, Nov 07, 2015 at 07:46:47AM +0900, Randy Bush wrote:
> > The following RIR IRR's are in use today: RIPE, APNIC, AfriNIC, ARIN.
> 
> most operators in X do not register routes in irrX for all X except RIPE

Sorry, I don't understand what you are saying here.

> > I do not agree with "most rir irr instances are unused".
> 
> cool.  maybe you could back your disagreement up with measurement.

Anybody who generate filters using the IRRd query protocol with a client
like peval, bgpq3 or something in-house; pointed at whois.radb.net or
rr.ntt.net, indirectly use those RIR IRRs. 

I know my employer uses the rr.ntt.net instance on a daily basis. I
cannot measure whether other people's queries against rr.ntt.net result
in prefix filters being deployed somewhere.

Here are some measurements from August 2015 comparing what objects are
in IRR and which of those objects were 'confirmed' in BGP DFZ.

DB      | IRR objects | Corresponding BGP announcements (match pfx + origin)
--------+-------------+-------------+-- ratio
JPIRR   |        8889 |       6478  |   .728
BBOI    |        1330 |        766  |   .575
RIPE    |      286294 |     139263  |   .486  <-- RIR
Afrinic |         496 |        237  |   .477  <-- RIR
TC      |        3090 |       1411  |   .456
ALTDB   |       13440 |       5169  |   .384
APNIC   |       97955 |      30219  |   .308  <-- RIR
ARIN    |       26872 |       8256  |   .307  <-- RIR
GT      |        2474 |        745  |   .301
LEVEL3  |       89812 |      23198  |   .258
RADB    |      769328 |     145845  |   .189
SAVVIS  |      103362 |      19064  |   .184
NTTCOM  |      238914 |      43832  |   .183
RGNET   |         314 |         45  |   .143
BELL    |       29545 |        656  |   .022
--------------------------------------------

I only looked for exact matches in the DFZ (table taken from NLNOG RING
LG with ~ 50 feeds). I did not check what the ratio is like when taking
more-specific announcements for registered prefixes into consideration.

Kind regards,

Job