[rpd] AfriNIC audit data

[John Hay]

There is also the case where universities and research organisations have
their own address space, but it is announced from the NREN's ASN.

Regards

John


On Fri, 24 Oct 2025 at 15:20, Fernando Frediani <fhfrediani at gmail.com>
wrote:

> Yes there are legitimate cases, but when this happens it may be a signal
> of alert. The point is to find two things: 1) If the ASN announcing it
> doesn't have any relation to the resource holder and 2) If resources are
> being used out of the region (the worst).
> For the case of parent/sub-company ideally resources should be
> transferred among companies using them in reality then.
>
> Fernando
>
> On 10/24/2025 7:45 AM, Andrew Alston wrote:
> > Hi All,
> >
> > While I haven't got around to publishing the code behind this - mainly
> > because it by necessity exposes certain data and requires a BGP dump
> > from a juniper router which is hundreds of megs big, I've attached the
> > output of the code I wrote.
> >
> > One caveat with this data - There is nothing inherently wrong with
> > space allocated to an organisation being announced by a non-AfriNIC
> > ASN, there are many legitimate cases and reasons behind this.  The
> > same thing happens when space is allocated to one organisation but
> > announced by another, and this can happen when a sub-company of a
> > parent company is announcing space from their own ASN when the space
> > was originally allocated to the parent.  As such, when reading this
> > data, it's important to understand that the abnormalities detected do
> > not necessarily indicate anything nefarious - and this data should not
> > be seen as accusations of malfeasance against anyone.
> >
> > Let's see if the lists let this post through!
> >
> > Thanks
> >
> > Andrew
> >
> >
> > _______________________________________________
> > RPD mailing list
> > RPD at afrinic.net
> > https://lists.afrinic.net/mailman/listinfo/rpd
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20251024/1583dd14/attachment-0001.html>