[ripe-db-requirements-tf] IRT Query Statistics

Hi all,

Here are some more detailed statistics for IRT queries made in January this year.

(1) 204,318 total queries specifying irt flag (-c / --irt)

These requests came from 497 distinct IP addresses.

13 IP addresses made >1,000 requests, which accounted for 185,910 total requests, or 91% of the total.

Of these 13 IP addresses, 6 are in the same /24 network, which accounted for 88,493 total requests, or 43%

The vast majority of the requests were for a single IPv4 address, which wasn't repeated (i.e. no polling).

(2) 546 total queries specifying an IRT- primary key.

These requests came from 139 distinct IP addresses.

A single IP address made 135 requests, or 25% of the total.

There were 63 distinct queries with an IRT- primary key (i.e. some queries were repeated a few times).

Regards
Ed




> On 2 Mar 2020, at 10:25, Edward Shryane <eshryane at ripe.net> wrote:
> 
> Hi all,
> 
> Here are some statistics on IRT queries for January. How much usage do these IRT objects get?
> 
> Some background reading on IRT objects:
> https://www.ripe.net/manage-ips-and-asns/db/irt
> https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-database-documentation/rpsl-object-types/4-3-descriptions-of-secondary-objects/4-3-2-description-of-the-irt-object
> 
> The IRT object is meant to be used by Incident Response Teams directly, and "abuse-c:" is meant for general abuse complaints.
> 
> IRT objects are *not* returned by default in Whois queries. Users must either specify the -c / --irt flag on an IP lookup, or specify the IRT-* primary key.
> 
> There are about 400 IRT objects in the Whois database. To reference an IRT object from an IP range, you must add an "mnt-irt" attribute (and authenticate with the IRT object). I found 12,694 references to IRT objects from inetnums, and 901 references from inet6nums. A total of 174 distinct IRT objects are referenced (leaving 226 unreferenced).
> 
> Out of 2 billion Whois queries in January, I found 204,318 queries with the irt flag (or ~7k/day), and 546 queries (or about 18/day) for an IRT object using the primary key.
> 
> Let me know if you have any questions or would like more details.
> 
> Regards
> Ed Shryane
> RIPE NCC
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2636 bytes
Desc: not available
URL: </ripe/mail/archives/ripe-db-requirements-tf/attachments/20200408/bd371c40/attachment.p7s>