WHEREIS: IP Address Registration Geo-Consistency

TL;DR

This paper introduces WHEREIS, a measurement-based method to geolocate IP address prefixes at RIR-region granularity, revealing registration data inconsistencies and informing policy and security considerations.

Contribution

We develop a systematic geolocation approach to assess IP registration geo-consistency and analyze discrepancies across RIRs, especially focusing on AFRINIC.

Findings

Over 98% of prefixes are consistent with geolocation inferences

IPv6 registrations are as inconsistent as IPv4

Inconsistencies affect commercial geolocation databases

Abstract

The five Regional Internet Registries (RIRs) provide the critical function of IP address resource del egation and registration. The accuracy of registration data directly impacts Internet operation, management, security, and optimization. In addition, the scarcity of IP addresses has brought into focus conflicts between RIR policy and IP registration ownership and use. The tension between a free-market based approach to address allocation versus policies to promote fairness and regional equity has resulted in court litigation that threatens the very existence of the RIR system. We develop WHEREIS, a measurement-based approach to geolocate delegated IPv4 and IPv6 prefixes at an RIR-region granularity and systematically study where addresses are used post-allocation and the extent to which registration information is accurate. We define a taxonomy of registration ``geo-consistency'' that compares a prefix's measured geolocation to the allocating RIR's coverage region as well as the registered organization's location. While in aggregate over 98% of the prefixes we examine are consistent with our geolocation inferences, there is substantial variation across RIRs and we focus on AFRINIC as a case study. IPv6 registrations are no more consistent than IPv4, suggesting that structural, rather than technical, issues play an important role in allocations. We solicit additional information on inconsistent prefixes from network operators, IP leasing providers, and collaborate with three RIRs to obtain validation. We further show that the inconsistencies we discover manifest in three commercial geolocation databases. By improving the transparency around post-allocation prefix use, we hope to improve applications that use IP registration data and inform ongoing discussions over in-region address use and policy.