[rpd] AfriNIC audit data

[Andrew Alston]

Some companies prefer to hold all the space in the parent company and
allocate it downwards themselves to sub-entities because of the way the
AfriNIC fee structure works - it gets to a point where it is *far* cheaper
to hold all the space in a single entity than to have seperate space held
by loads of entities.

With regards to space being used out of region - that's extremely difficult
to actually know - because the BGP table has no knowledge of geography :)

Thanks

Andrew


On Fri, Oct 24, 2025 at 4:11 PM Fernando Frediani <fhfrediani at gmail.com>
wrote:

> Yes there are legitimate cases, but when this happens it may be a signal
> of alert. The point is to find two things: 1) If the ASN announcing it
> doesn't have any relation to the resource holder and 2) If resources are
> being used out of the region (the worst).
> For the case of parent/sub-company ideally resources should be
> transferred among companies using them in reality then.
>
> Fernando
>
> On 10/24/2025 7:45 AM, Andrew Alston wrote:
> > Hi All,
> >
> > While I haven't got around to publishing the code behind this - mainly
> > because it by necessity exposes certain data and requires a BGP dump
> > from a juniper router which is hundreds of megs big, I've attached the
> > output of the code I wrote.
> >
> > One caveat with this data - There is nothing inherently wrong with
> > space allocated to an organisation being announced by a non-AfriNIC
> > ASN, there are many legitimate cases and reasons behind this.  The
> > same thing happens when space is allocated to one organisation but
> > announced by another, and this can happen when a sub-company of a
> > parent company is announcing space from their own ASN when the space
> > was originally allocated to the parent.  As such, when reading this
> > data, it's important to understand that the abnormalities detected do
> > not necessarily indicate anything nefarious - and this data should not
> > be seen as accusations of malfeasance against anyone.
> >
> > Let's see if the lists let this post through!
> >
> > Thanks
> >
> > Andrew
> >
> >
> > _______________________________________________
> > RPD mailing list
> > RPD at afrinic.net
> > https://lists.afrinic.net/mailman/listinfo/rpd
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20251024/4d872bc6/attachment.html>