[arin-ppml] Clarify /29 assignment identification requirement

[William Herrin]

On 5/4/12, David Krumme <david at airbits.com> wrote:
>> On 5/4/12, David Krumme <david at airbits.com> wrote:
>>>> I would think that any indirect evidence of a customer's existence
>>>> would support the address utilization claim. A bank statement listing
>>>> deposits and charges.
>>>
>>> Our bank statement shows all sources of our income and would not in any
>>> way tend to either validate or discredit our ISP activities.
>>
>> Hi David,
>>
>> It would demonstrate a plausible customer count (or the lack thereof)
>> for the address utilization you claimed.
>
> Um...our income comes from lots of sources and nothing on the bank
> statement would indicate the source of the income. I guess our total
> revenue would show up as being sufficient, but how much of that was due to
> Internet service would be impossible to detect. I don't see that that
> would be very informative.

Hi David,

It's not so much the dollars as the transaction count. If you claim
90% of a /18 is /32's and dynamic pools but your statement shows 50
transactions a month, something is very off. The transaction count
won't prove that your utilization report is legit any more than a list
of names and addresses does and it isn't intended to. It's simply an
attempt to catch you in a lie. If you don't get caught in a lie then
the presumption is that you're telling the truth.


>> Employee count to see if you're over the low water mark typical for
>> the size of your address holdings.
>
> We are a family business with no actual employees but several people
> working part-time, so that might be hard to evaluate. Also, our people are
> very productive, so we would probably look too small. I would be
> disappointed to think that our staff-to-customer ratio was anything close
> to what is typical for the industry.

If you're adding a /18 to your /20, half of it /32s and dynamic pools
yet have no full time employees then something is fishy. Unless you've
subbed out the tech work (which you can easily prove) there aren't
enough hours in the day for a couple people working part time to keep
up with an efficiently numbered network of that scale.

It's a question of consistency. Any way I ask the question, the story
of your business should be a story of one that could legitimately use
the addresses in the way you claimed. I can ask the question many
ways; I don't have to ask it in terms of customer identities to get a
coherent answer.


>> A de-identified data dump from your configuration system that shows
>> what (e.g. dialup accounts, email boxes, etc.) but not who (no account
>> names, real names, addresses, etc).
>
> Something based on email accounts could indeed be very informative. But
> without disclosing actual  email addresses, it's not clear what useful
> information could be disclosed.

Customer count. I can infer your rough customer count from the list of
configured services. And its more likely to be truthful than just
asking you the sum. If you fake it and then I ask for the list of
transactions on your bank statement and the two don't make any sense
together than I've caught you in a lie.

Meanwhile, if you have a /22 deployed to DHCP pools and another /24 to
/32 statics but your customer count is 500 then something is fishy.
Either they're not really deployed that way or you're not at 80%
utilization. If the customer count I inferred from the indirect data
is around 1500 the those same deployments then I can have a reasonably
high confidence that you've told the truth.

Sure, you could have lied to me... most customers buy something else
from you and only 50 of them buy IP services. But if you're this good
at telling a consistent lie then reading a list of names and addresses
isn't going to bust you either.

In fact, unless I'm prepared to pick up the phone and start polling
the folks on that customer list, I have just as much confidence that
you're telling the truth this way as I do from demanding a customer
list.

ARIN polling a random selection of the customer list. Doesn't that
open a can of worms.

Regards,
Bill Herrin





-- 
William D. Herrin ................ herrin at dirtside.com  bill at herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004