[rpd] AfriNIC audit data

[Fernando Frediani]

Yes there are legitimate cases, but when this happens it may be a signal 
of alert. The point is to find two things: 1) If the ASN announcing it 
doesn't have any relation to the resource holder and 2) If resources are 
being used out of the region (the worst).
For the case of parent/sub-company ideally resources should be 
transferred among companies using them in reality then.

Fernando

On 10/24/2025 7:45 AM, Andrew Alston wrote:
> Hi All,
>
> While I haven't got around to publishing the code behind this - mainly 
> because it by necessity exposes certain data and requires a BGP dump 
> from a juniper router which is hundreds of megs big, I've attached the 
> output of the code I wrote.
>
> One caveat with this data - There is nothing inherently wrong with 
> space allocated to an organisation being announced by a non-AfriNIC 
> ASN, there are many legitimate cases and reasons behind this.  The 
> same thing happens when space is allocated to one organisation but 
> announced by another, and this can happen when a sub-company of a 
> parent company is announcing space from their own ASN when the space 
> was originally allocated to the parent.  As such, when reading this 
> data, it's important to understand that the abnormalities detected do 
> not necessarily indicate anything nefarious - and this data should not 
> be seen as accusations of malfeasance against anyone.
>
> Let's see if the lists let this post through!
>
> Thanks
>
> Andrew
>
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd