[arin-ppml] Draft Policy ARIN-2021-8: Deprecation of the 'Autonomous System Originations' Field

[Hove, K.W. van (Koen, Student M-CS)]

Dear Job, all,

Let me preface this by saying that I hold no opinion regarding Draft Policy ARIN-2021-8. However, as an academic I believe having some statistics may be beneficial in the policy-making process.

I have looked at the WHOIS data from 2022-04-27 together with the RPKI data from 2022-04-28. In total there are 105275 ARIN WHOIS OriginAS entries, where an entry is defined as a prefix - origin AS pair. Out of these 105275, 90791 (approximately 86%) did not have an associated ROA. Out of the 14484 (approximately 14%) that did, 11477 (approximately 79%) were valid, and 3007 (approximately 21%) were invalid (i.e., the OriginAS in the WHOIS was not present for that prefix in the RPKI, but another OriginAS was).

If we were to extrapolate this to the missing entries, that would mean that out of the 105275 entries at ARIN, 83419 would be valid, and 21856 entries would be invalid. However, if we compare the RIPE RIS WHOIS data from 2022-04-29 with the missing ROA data from the OriginAS set, a different picture appears. I looked at the approximately 1 million RIS WHOIS entries, and for each one checked whether it matched an entry out of the OriginAS set that was not covered by a ROA (so the set of 90791). For each, I checked whether an OriginAS entry existed, or an OriginAS entry existed for a supernet of this entry (e.g., if there is a 1.2.3.0/24 in RIS WHOIS, I checked for 1.2.3.0/24 up to 0.0.0.0/0). Most entries of course could not be matched, but out of the 103233 RIS WHOIS entries that could be matched, 71912 (approximately 70%) did match the OriginAS entry, and 31321 (approximately 30%) did not match the OriginAS entry. 

Should there be any question regarding the data or the methods, please let me know.

Yours sincerely,
Koen van Hove