WHEREIS: IP Address Registration Geo-Consistency

TL;DR

This paper presents WHEREIS, a measurement-based framework for geolocating delegated IPv4 and IPv6 prefixes at an RIR-region level and assessing the accuracy of registration data. By ingesting bulk WHOIS data, performing active delay-based geolocation with RIPE Atlas, and classifying prefixes into a five-tier geo-consistency taxonomy (FC, OC, OI, RI, FI), the authors quantify post-allocation address usage and registry accuracy. They find that over 98% of prefixes are geo-consistent overall, with meaningful variation across RIRs—AFRINIC showing more inconsistencies, and IPv4 and IPv6 exhibiting similar levels of geo-consistency. The study also links geo-inconsistencies to leasing activity, AFRINIC policy debates, and geolocation-database outputs, and it validates results with case studies and cross-RIR collaboration, highlighting the value of transparency in post-allocation prefix use for operational and policy applications.

Abstract

The five Regional Internet Registries (RIRs) provide the critical function of IP address resource del egation and registration. The accuracy of registration data directly impacts Internet operation, management, security, and optimization. In addition, the scarcity of IP addresses has brought into focus conflicts between RIR policy and IP registration ownership and use. The tension between a free-market based approach to address allocation versus policies to promote fairness and regional equity has resulted in court litigation that threatens the very existence of the RIR system. We develop WHEREIS, a measurement-based approach to geolocate delegated IPv4 and IPv6 prefixes at an RIR-region granularity and systematically study where addresses are used post-allocation and the extent to which registration information is accurate. We define a taxonomy of registration ``geo-consistency'' that compares a prefix's measured geolocation to the allocating RIR's coverage region as well as the registered organization's location. While in aggregate over 98% of the prefixes we examine are consistent with our geolocation inferences, there is substantial variation across RIRs and we focus on AFRINIC as a case study. IPv6 registrations are no more consistent than IPv4, suggesting that structural, rather than technical, issues play an important role in allocations. We solicit additional information on inconsistent prefixes from network operators, IP leasing providers, and collaborate with three RIRs to obtain validation. We further show that the inconsistencies we discover manifest in three commercial geolocation databases. By improving the transparency around post-allocation prefix use, we hope to improve applications that use IP registration data and inform ongoing discussions over in-region address use and policy.

Figures (9)

• Figure 1: Example ARIN prefix registration record. The corresponding organization's country, Brazil, is within the region of a different RIR. WHEREIS seeks to resolve this by geolocating the prefix's true location.
• Figure 2: A WHOIS prefix record can align with BGP or be a subnet, supernet, or a supernet containing BGP announcements from different ASNs. In some cases, the WHOIS prefix may not be advertised in the BGP.
• Figure 3: WHEREIS methodology: RIR prefixes are ingested into a database. Probing logic uses IPv4 and IPv6 hitlists to drive RIPE Atlas active probing for constraint-based geolocation and RIR consistency checks.
• Figure 4: WHEREIS uses RIPE Atlas and constraint-based geolocation to infer true prefix locations. To tighten the feasible geolocation region, we use stable Atlas anchor nodes known to be in each RIR's region as well as nodes within the country of the prefix's registered owner. If the feasible geolocation matches either the responsible RIR or the RIR of the owner, we call the registration "consistent," else "inconsistent."
• Figure 6: Per-RIR WHERE results: >98% of classified prefixes are fully or organization consistent (FC/OC).