[rpd] AfriNIC audit data

[Fernando Frediani]

On Fri, 24 Oct 2025, 10:18 Andrew Alston, <aa at alstonnetworks.net> wrote:

>
> With regards to space being used out of region - that's extremely
> difficult to actually know - because the BGP table has no knowledge of
> geography :)
>

I wouldn't say it is trivial but with geolocation data plus some
traveroutes and latency check it is not extremelly dificult to find out.

With some intended work that can be found out and further investigate to
give AfriNic all necessary information.

Fernanso

>
> On Fri, Oct 24, 2025 at 4:11 PM Fernando Frediani <fhfrediani at gmail.com>
> wrote:
>
>> Yes there are legitimate cases, but when this happens it may be a signal
>> of alert. The point is to find two things: 1) If the ASN announcing it
>> doesn't have any relation to the resource holder and 2) If resources are
>> being used out of the region (the worst).
>> For the case of parent/sub-company ideally resources should be
>> transferred among companies using them in reality then.
>>
>> Fernando
>>
>> On 10/24/2025 7:45 AM, Andrew Alston wrote:
>> > Hi All,
>> >
>> > While I haven't got around to publishing the code behind this - mainly
>> > because it by necessity exposes certain data and requires a BGP dump
>> > from a juniper router which is hundreds of megs big, I've attached the
>> > output of the code I wrote.
>> >
>> > One caveat with this data - There is nothing inherently wrong with
>> > space allocated to an organisation being announced by a non-AfriNIC
>> > ASN, there are many legitimate cases and reasons behind this.  The
>> > same thing happens when space is allocated to one organisation but
>> > announced by another, and this can happen when a sub-company of a
>> > parent company is announcing space from their own ASN when the space
>> > was originally allocated to the parent.  As such, when reading this
>> > data, it's important to understand that the abnormalities detected do
>> > not necessarily indicate anything nefarious - and this data should not
>> > be seen as accusations of malfeasance against anyone.
>> >
>> > Let's see if the lists let this post through!
>> >
>> > Thanks
>> >
>> > Andrew
>> >
>> >
>> > _______________________________________________
>> > RPD mailing list
>> > RPD at afrinic.net
>> > https://lists.afrinic.net/mailman/listinfo/rpd
>>
>> _______________________________________________
>> RPD mailing list
>> RPD at afrinic.net
>> https://lists.afrinic.net/mailman/listinfo/rpd
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20251024/17cc2856/attachment.html>