Discrepancy between WHOIS and delegated-ripencc

Hello! This might not be the appropriate place for my question; if that is so, I apologize in advance. I've noticed that the data provided by the RIPE WHOIS database is sometimes inconsistent with the data shown in the delegated-ripencc-latest file, available from the ftp://ftp.ripe.net/ripe/stats/ server. For example, consider these two entries: ------------------------------------------------------- $ whois 91.212.135.0/24 inetnum: 91.212.135.0 - 91.212.135.255 netname: YABA-NET descr: YabaMedia Ltd country: RU $ grep 91.212.135.0 delegated-ripencc-latest ripencc|CZ|ipv4|91.212.135.0|256|20090409|assigned ------------------------------------------------------- $ whois 193.105.207.0/24 inetnum: 193.105.207.0 - 193.105.207.255 netname: ALFAHOSTNET descr: Alfa-host LLP. country: KZ $ grep 193.105.207.0 delegated-ripencc-latest ripencc|CZ|ipv4|193.105.207.0|256|20100315|assigned ------------------------------------------------------- As you can see, the data differs in the "country" field -- in both cases, the range is attributed to Czech Republic, while the block is actually assigned to anothers. Since the delegated-ripencc-latest file is used by some reputable and often-used sources (like Team Cymru; http://www.team-cymru.org/Services/ip-to-asn.html), this can sometime result in misleading and completely useless reports (as you can probably guess, it was Czech Republic getting unfair load of hostile sites attributed to it). There are two questions now: 1) What is the source of this discrepancy? 2) If it was caused by some kind of an error, can the databases be put in sync? If it is intentional, which source is more "reliable"? Thanks, Peter -- [Name] Peter Kosinar [Quote] 2B | ~2B = exp(i*PI) [ICQ] 134813278

Dear Peter The "country:" attribute in the RIPE Database can be set by the resource Holder to any valid, international country code. It has little meaning to anyone other than the resource Holder. Only they know what they had in mind when they set it. To explain the problem simply, it could be the country where the resource Holder is physically located, or the country of a data centre or the country where the resource is being used. This has been discussed a few times at RIPE Meetings but no consensus has been reached on a strict definition of this attribute. The RIPE NCC has just published an article on RIPE Labs about an idea to separate some of the registration data in the RIPE Database into two parts. A fixed part containing data supplied to the RIPE NCC by the resource Holder and another part with data the resource Holder can change at any time. In the prototype we have included "country:" in both parts of this data. The intention is to have a strict definition of what 'country' means from a registration perspective in the fixed part of the data. https://labs.ripe.net/Members/Paul_P_/a-new-ripe-database-prototype I hope this helps. Regards Denis Walker Business Analyst RIPE NCC Database Group Peter Kosinar wrote:
Hello!
This might not be the appropriate place for my question; if that is so, I apologize in advance.
I've noticed that the data provided by the RIPE WHOIS database is sometimes inconsistent with the data shown in the delegated-ripencc-latest file, available from the ftp://ftp.ripe.net/ripe/stats/ server. For example, consider these two entries:
------------------------------------------------------- $ whois 91.212.135.0/24
inetnum: 91.212.135.0 - 91.212.135.255 netname: YABA-NET descr: YabaMedia Ltd country: RU
$ grep 91.212.135.0 delegated-ripencc-latest ripencc|CZ|ipv4|91.212.135.0|256|20090409|assigned ------------------------------------------------------- $ whois 193.105.207.0/24
inetnum: 193.105.207.0 - 193.105.207.255 netname: ALFAHOSTNET descr: Alfa-host LLP. country: KZ
$ grep 193.105.207.0 delegated-ripencc-latest ripencc|CZ|ipv4|193.105.207.0|256|20100315|assigned -------------------------------------------------------
As you can see, the data differs in the "country" field -- in both cases, the range is attributed to Czech Republic, while the block is actually assigned to anothers. Since the delegated-ripencc-latest file is used by some reputable and often-used sources (like Team Cymru; http://www.team-cymru.org/Services/ip-to-asn.html), this can sometime result in misleading and completely useless reports (as you can probably guess, it was Czech Republic getting unfair load of hostile sites attributed to it).
There are two questions now: 1) What is the source of this discrepancy?
2) If it was caused by some kind of an error, can the databases be put in sync? If it is intentional, which source is more "reliable"?
Thanks,
Peter

Hi Peter, probably I know the answer. The first network was registered through our LIR, which is located in Czech republic. The regid of LIR is cz.netart. It seems that quoted file contains the value of LIR country as country field. Whois data is more reliable. I told this several times to many GeoIP providers. Friday, November 5, 2010, 7:24:46 PM, you wrote: PK> Hello! PK> This might not be the appropriate place for my question; if that is so, I PK> apologize in advance. PK> I've noticed that the data provided by the RIPE WHOIS database is PK> sometimes inconsistent with the data shown in the delegated-ripencc-latest PK> file, available from the ftp://ftp.ripe.net/ripe/stats/ server. For PK> example, consider these two entries: PK> ------------------------------------------------------- PK> $ whois 91.212.135.0/24 PK> inetnum: 91.212.135.0 - 91.212.135.255 PK> netname: YABA-NET PK> descr: YabaMedia Ltd PK> country: RU PK> $ grep 91.212.135.0 delegated-ripencc-latest PK> ripencc|CZ|ipv4|91.212.135.0|256|20090409|assigned PK> ------------------------------------------------------- PK> $ whois 193.105.207.0/24 PK> inetnum: 193.105.207.0 - 193.105.207.255 PK> netname: ALFAHOSTNET PK> descr: Alfa-host LLP. PK> country: KZ PK> $ grep 193.105.207.0 delegated-ripencc-latest PK> ripencc|CZ|ipv4|193.105.207.0|256|20100315|assigned PK> ------------------------------------------------------- PK> As you can see, the data differs in the "country" field -- in both cases, PK> the range is attributed to Czech Republic, while the block is actually PK> assigned to anothers. Since the delegated-ripencc-latest file is used by PK> some reputable and often-used sources (like Team Cymru; PK> http://www.team-cymru.org/Services/ip-to-asn.html), this can sometime PK> result in misleading and completely useless reports (as you can probably PK> guess, it was Czech Republic getting unfair load of hostile sites PK> attributed to it). PK> There are two questions now: PK> 1) What is the source of this discrepancy? PK> 2) If it was caused by some kind of an error, can the databases be put in PK> sync? If it is intentional, which source is more "reliable"? PK> Thanks, PK> Peter -- Sergey
participants (3)
-
Denis Walker
-
Peter Kosinar
-
Sergey Myasoedov