Re: [nanog] [nanog] 2749 routes AT RISK - Re: TIMELY/IMPORTANT -

[John Curran <jcurran () arin net>]

On 5 Apr 2022, at 12:21 AM, Dan Mahoney (Gushi) <danm () prime gushi org<mailto:danm () prime gushi org>> wrote:

John (C), just out of curiosity, is there a good count of how many of these resources exist (i.e. legacy resources 
without an LRSA?).  If you can easily say an aggregate number I'm curious.

In terms of IPv4 address space not under contract, less and less each year…  About 42% of the ARIN registry space is 
legacy resources not under contract, and this has been steadily dropping.   It was obviously 100% at ARIN’s formation, 
and presently slope is about -3% per year.

In terms of organization count -

16,000+ Members  (organizations that have a valid ARIN Registration Services Agreement (RSA or LRSA) for IPv4 and/or 
IPv6 address space are Service Members of ARIN, and any in good standing can opt to be a General Member with voting 
rights.)

In addition, ARIN serves approximately 15,000 Legacy customers which hold IPv4 Internet number resources that are not 
currently covered under any type of RSA or LRSA with ARIN.

In addition, ARIN also serves approximately 7,600 ASN-only organizations.

Source: <https://www.nro.net/about/rirs/>

Is there a count of how many of these are present in the DFZ, or that are being announced by larger netblocks, or which 
do not show in the BGP table at all?

Excellent question, and the answer is unknown.  The fact that such a statistic is not easy to derive from public 
information is something that was recently brought to my attention and we will work to fix shortly.

Given, this is a list of potentially-hijackable address blocks, so I don't know that such a thing should be posted 
publicly, but I could see research being done with the full set under a confidentiality agreement.  (If such a thing 
has been done, please point me at it).

I have not seen such work done.

This feels like an interesting research presentation/lightning talk/something to me, relevant in the world where we're 
talking about declawing third party registries.

We do provide bona fide researchers bulk access to registry data <https://www.arin.net/reference/research/bulkwhois/> 
(and could provide additional instrumentation if necessary for such a research activity.)

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers