RIPE NCC Annual Report 2004

Document ID: ripe-tba
Date: May 2005

1.0 Foreword
2.0 Summary and Outlook
3.0 What is the RIPE NCC: Role and Structure
4.0 Membership Report
5.0 Services and Projects
5.1 Registration Services
5.2 Membership Liaison
5.3 Database Services
5.4 DNS Services
5.5 Test Traffic Measurements Service
5.6 Routing Information Service
5.7 Deployment of Internet Security Infrastructure (DISI)
5.8 DNS Monitoring Service
5.9 ENUM
6.0 RIPE
7.0 RIPE NCC in the Internet Industry
8.0 Financial Report 2004

1.0 Foreword

In November 2004, ICANN released its three-year strategic plan for public comment. The RIPE NCC will gather comments on this document from its regional communities, before making a joint statement through the Number Resource Organization (NRO) in the first quarter of 2005. The RIPE NCC continues to support the ICANN framework, and welcomes this opportunity to offer constructive criticism based on the input of all the RIR communities.

The RIRs and a range of industry partners have participated in the World Summit on the Information Society (WSIS) processes for over a year, including regional Prepcoms and the Summit itself. The outcome of the WSIS could impact seriously on the bottom-up, industry self-regulatory processes that have underpinned the Internet since its inception.

The RIRs, acting in concert via the NRO, have made a number of public responses detailing the effective, current processes that are used for developing IP address distribution policies. In addition, the NRO has been key in responding to proposals that would undermine the stability of the Internet and that would have a negative impact on the operations of the RIRs’ members and the Internet community as a whole.

Many organisations and individuals have helped the RIPE NCC to perform its functions. I would like to end this foreword with a big thanks to all of them. But please be aware that we count on your support for the coming year too. The power of the RIPE NCC is not only in co-ordination, but even more in co-operation.

2.0 Summary and Outlook

To help evaluate and address the changing needs of RIPE NCC members across our large and diverse service region, the RIPE NCC held two RIPE NCC Regional Meetings in 2004. The first meeting was held in Moscow in June and the second was held in Nairobi in July. The regional meetings have helped the RIPE NCC to develop local contact and support, and to gather valuable input and comments from members in particular areas of its service region. Regional meetings also bring the RIPE NCC closer to its members who are not able to participate in RIPE Meetings, providing a perfect opportunity for establishing direct contact and promoting open dialogue. Additionally, the regional meetings bring members from a specific region closer to the RIPE community and encourage their participation in RIPE Meetings, RIPE Working Groups and the policy-making process. The RIPE NCC plans to hold more regional meetings in 2005.

In order to ensure that the RIPE NCC continues to meet its members’ needs, in 2005 the RIPE NCC will commission an independent member survey, similar to the survey conducted by KPMG in 2002. Based on the results of this survey, and in close interaction with the members, the RIPE NCC will continue to improve its operational quality and organisational structure.

In October 2004, we launched an updated version of the www.ripe.net website. We redesigned the site to better meet the needs of RIPE NCC members and others in the Internet community by providing improved access to information and resources.

In 2004, the RIPE community decided to hold two RIPE Meetings in 2005. The RIPE NCC will offer additional support to RIPE Working Groups to facilitate discussion and progress between RIPE Meetings. In consultation with the RIPE Chair, the RIPE NCC will also investigate the timing of the RIPE NCC General Meeting in order to integrate it more fully into the RIPE Meeting week.

The RIPE NCC will continue to work with AfriNIC and the other Regional Internet Registries (RIRs) to support the emergence of AfriNIC as a formally recognised RIR. Following AfriNIC’s provisional recognition by ICANN in 2004, AfriNIC is now a provisional member of the NRO. It is expected that AfriNIC will become a formally recognised RIR in 2005.

The RIPE NCC, working with the other RIRs through the NRO, continues to represent the Internet community and to maintain support for the bottom-up, industry self-regulatory processes used by all RIR communities. In this respect, we are looking forward to developing the relationship between the Address Supporting Organization (ASO) and ICANN’s Government Advisory Committee (GAC) together with the newly appointed GAC liaison role that has been created for each RIR community.

The RIPE NCC, together with the other RIRs and industry partners, has participated in the World Summit on the Information Society (WSIS) processes. The RIRs have attended as experts to assist in debates and discussions around issues related to Internet number resources in general and to IP addresses in particular. This important work will be continued during the coming year.

Today, the RIPE NCC has been successful for 12 years in providing the allocation of Internet number resources to its members, as well as technical co-ordination and information services to the Internet community at large. I would like to take this opportunity once more to thank the RIPE NCC members for their ongoing support of the RIPE NCC and call for their continued participation in the long-established processes that have been developed by the Internet community over the years.

3.0 What is the RIPE NCC?

All activities and projects are described in the annual RIPE NCC Activity Plan available at:

http://www.ripe.net/ripe/docs/ap2004.html

The mission of the RIPE NCC is to perform activities for the benefit of the membership, primarily activities that the members need to organise as a group, although they may compete with each other in other areas. While an activity may result in services being provided to an individual member, performing the activity as a whole must benefit the RIPE NCC membership as a group.

Membership is open to anyone using the RIPE NCC services. The activities and services of the RIPE NCC are defined, performed, discussed and evaluated in an open manner. In all of its activities, the RIPE NCC observes strict neutrality and impartiality in regard to individual members. The RIPE NCC membership consists mainly of Internet Service Providers (ISPs), telecommunication organisations and large corporations.

More information about the activities of the RIPE NCC is given in the RIPE NCC Information Sheet, available at:

http://www.ripe.net/ripencc/about/infosheet.pdf

A detailed map of the RIPE NCC service region can be found at:

http://www.ripe.net/membership/maps/index.html

Structure

The organisational structure of the RIPE NCC consists of:

• Members who provide input on the RIPE NCC Activity Plan and Budget and who vote on the RIPE Charging Scheme at the RIPE NCC General Meeting; they also give general input on the activities and services of the RIPE NCC through participation on public mailing lists and at open RIPE Meetings

• The Executive Board as appointed by the RIPE NCC membership

• The RIPE NCC staff

5.0 Services and Projects

5.1 Registration Services

The RIPE NCC processed a total of 26,385 requests for resources and related services in 2004. This is an increase of 12%, compared with the 23,535 requests received in 2003. The initial response times for resource requests and membership applications continued to remain stable during 2004. The time taken to complete requests has been reduced during the year and the RIPE NCC is working hard towards continuing to improve these levels of service.

IPv4

The RIPE NCC allocated more than 38 million IPv4 addresses during 2004. This represents 2.27 /8s and is an increase of 30%, compared with the 1.75 /8s that were allocated during the preceding year. The IANA allocated 4.0 /8s to the RIPE NCC in April 2004
- [85.0.0.0 - 88.255.255.255].

IPv6

The IANA allocated 29 /23 IPv6 address ranges to the RIPE NCC in January, May, June, August, September, October and December 2004. The ranges allocated to the RIPE NCC at the end of 2004 were:

• 2001:0600::/23
• 2001:0800::/22
• 2001:1400::/22
• 2001:1A00::/23
• 2001:1C00::/22
• 2001:2000::/20
• 2001:3000::/21
• 2001:3800::/22
• 2001:4000::/23
• 2001:4600::/23
• 2001:4A00::/23
• 2001:4C00::/23
• 2001:5000::/20

The number of IPv6 allocations made by the RIPE NCC continued to rise rapidly in 2004. 147 /32 allocations were made during the year, which brings the total number of IPv6 allocations made by the RIPE NCC since it started allocating IPv6 address space in 1999 to 418 /32s. By the end of 2004, 58 of the 63 /35 allocations that were made under the provisional IPv6 policy had been expanded to a /32 (the current minimum allocation size). One allocation was returned during the year.

The RIPE NCC also made several allocations larger than the minimum /32 prefix length. These included a /27, a /24, a /23, a /21 and a /20. A /32 allocation was expanded to a /30 to provide the LIR with sufficient IPv6 address space to meet its needs.

Twelve /48 assignments were made to Internet Exchange Points (IXPs) during 2004.

In accordance with the policy allowing root name server operators to receive a block of the minimum allocation size, the RIPE NCC has assigned two /32s to root name servers I and K.

More information about this policy is available at:

http://www.ripe.net/ripe/docs/ipv6-rootservers.html

Autonomous System Numbers

An Autonomous System (AS) is a group of IP networks run by one or more network operators with a single, clearly defined routing policy.

The RIPE NCC assigned 1,490 AS Numbers during 2004. This is an increase of 18.7%, compared with the 1,255 AS Numbers that were assigned during 2003. The IANA allocated a new block of 1,024 AS Numbers to the RIPE NCC in June 2004.

Early Registration Transfer (ERX)

When the American Registry for Internet Numbers (ARIN) was formed in December 1997, it inherited the InterNIC database of existing IP addresses and AS Numbers, as well as the responsibility of maintaining the records in it. These records became known as "early registrations". It was decided by the RIR communities that the interests of the early registration holders would best be served by managing the resources through the RIR appropriate to the region in which they reside. The ERX (Early Registration Transfer) Project started in August 2002, when the RIPE NCC transferred AS Number registrations from the ARIN database to the RIPE Database. IPv4 registration transfers began in December that year.

The RIPE NCC started the final stage of the ERX Project in July 2004. This transfer involves the former Class C registrations. By the end of 2004, a total of 13,692 registrations had been transferred (4,211 in 2003 and 9,481 in 2004). So far, 41 /8s have been processed. The transfer of the final /8 (192/8) will be completed in February 2005.

Training

In September 2004, Training Services separated from Registration Services and became an independent department within the RIPE NCC.

During the year, the RIPE NCC offered 69 training courses in 32 countries throughout the RIPE NCC service region. In total, about 1,600 LIR staff members were trained in 2004. The objective of the LIR Training Courses is to train members how to request Internet resources and how to use the RIPE Whois Database. The training material is updated quarterly. New policies and modifications to processes or software are included to keep the information presented in the training courses as up-to-date as possible.

The RIPE NCC also continued giving technical courses in 2004. The Routing Registry (RR) Training Course, aimed at experienced network operators, explains the features of the Routing Registry and the related tools. It also aims to introduce relevant services of the RIPE NCC and explain the basics of the Routing Policy Specification Language (RPSL). The course is given through presentations, demonstration of tools and interactive practical exercises.

The DNS Security (DNSSEC) Training Course is aimed at experienced DNS operators and explains how to implement DNSSEC in an operational environment.

Additionally, IP Request Tutorials were given at RIPE Meetings. The tutorials contained basic material selected from the current LIR Training Course material and were open to all meeting participants. RIPE NCC Seminars were held in Moscow, Kazakhstan and Kenya. These seminars included material from all the three RIPE NCC training courses. In 2004, the RIPE NCC also started giving courses at venues provided by host companies.

The RIPE NCC continuously tries to find ways to improve its training services and to reach as many members and representatives from the RIPE community as possible. The RIPE NCC is continuing to investigate the use of new training methods and media formats that will allow the Training Services Department to provide a better service and to train more people cost-effectively.

LIR Portal

The RIPE NCC LIR Portal offers LIRs an easy and intuitive web interface to access RIPE NCC services.

The LIR Portal has become increasingly popular throughout 2004. By the end of the year, over 60% of “Provider Aggregatable” (PA) assignment requests came through the LIR Portal rather than by e-mail.
Throughout 2004, the following features were added to the LIR Portal:

• Registry data was made available in XML format, which is useful for members who wish to process it further with their own software.
• Really Simple Syndication (RSS) feeds were added for RIPE training, news and events.
• ‘Save’ and ‘resume’ functions were added for forms, allowing users to start and stop the process of submitting a request as needed.
• Additional information was made available about ticket status.

A number of additional changes, such as improved help text and easier to use menu options, have also been added.

Additionally, during 2004 the RIPE NCC used the LIR Portal for a number of member-only surveys, and to get input from the LIRs in a structured way.

Policy Development in 2004

The RIPE NCC follows Internet address distribution policies developed by community consensus in the RIPE Address Policy Working Group, which has open discussions at RIPE Meetings and on public mailing lists. In 2004, the following policy developments were noted:

• In April 2004, the RIPE NCC updated a number of request forms and their supporting notes. This was necessary to accommodate the new organisation object and "mnt-domains:" attribute, and to incorporate feedback from the RIPE NCC members.

• There were also several policy discussions during the year:

• Allowing small, “Provider Independent” (PI) assignments for critical infrastructure. [January, June]
• Changing the 80% rule for IPv4 allocations. [February]
• Clarification of IPv6 initial allocation criteria for IPv6. [June, July]

• One policy change was implemented after consensus was reached in May 2004:

• The minimum allocation size was reduced from /21 to /22 for African LIRs. Those allocations are taken from 196.200.0.0/13.

The RIPE NCC will continue its efforts to keep policy documentation clear and concise.

Policy changes will be reported in an efficient and easily accessible format. The RIPE Document Store has a listing of recent changes to RIPE Documents. This is available at:

http://www.ripe.net/ripe/docs/updates.html

5.2 Membership Liaison

The Membership Liaison Officer (MLO) is responsible for managing liaison activities and regional support to all members throughout the RIPE NCC service region. The MLO provides an accessible point of contact for members, and for issues or feedback that they wish to bring forward to the RIPE NCC. The primary function of these activities is to make it easier to continuously evaluate and address the changing needs of RIPE NCC members.

This includes establishing close contact with the RIPE NCC Services Working Group and following a more focused approach to industry-related meetings and events. The MLO also co-ordinates regional support activities that enable the RIPE NCC to establish and maintain direct contact with members across its entire service region.

RIPE NCC Regional Meetings

5.3 Database Services

One of the main public services provided by the RIPE NCC is the operation and maintenance of the RIPE Whois Database. The database contains information about IPv4 and IPv6 address space allocations and ASN allocations, and related organisation and contact information. “Domain Name System” (DNS) reverse delegation is present for the IPv4 and IPv6 address space allocations. An Internet Routing Registry (IRR), primarily for the RIPE NCC region, is also part of the RIPE Database.

This information is used by a range of people, including network engineers, system administrators, researchers and end users, for various purposes such as network troubleshooting or determining abuse contacts. In most cases these users are not RIPE NCC members.

Information about the RIPE Whois Database can be found at:

http://www.ripe.net/db/index.html

You can query the database either by using a WHOIS client directed to whois.ripe.net, or by using a web browser at:

http://www.ripe.net/whois

Facts & Figures

Most of the records in the RIPE Database are inetnum objects, which represent IPv4 allocations and assignments, and person and role objects, which contain contact data. The contents of the database grew steadily in 2004, from 2 million to 2.5 million records.

The average query rate did not increase over 2004, for the first time in the history of the RIPE Database. It remains about 30 queries/second on a weekly basis. These queries come from over 75 thousand unique IP addresses each day, and return about five million records to the users.

The web interface became an increasingly popular way for users to query the database. A link that allows queries was added to the front page of the www.ripe.net website as part of the website redesign, making the page more accessible. About 25% of queries to the database are through the web page on the www.ripe.net web server.

New and Modified Database Features

Changes to the RIPE Database are discussed in the RIPE Database Working Group. Once consensus is achieved, the RIPE NCC presents a specific proposal to the working group, then implements the new or changed features to the software. The following were the highlights from 2004:

Improved Secure Communications for RIPE NCC Members

• X.509 Integration

  As part of the "Improved Secure Communications for RIPE NCC Members" project, the RIPE Whois Database was extended to support X.509 authentication. This support was added in March 2004.

  The main component of this change was modifying the key-cert object type to allow it to store X.509 certificates as well as PGP keys. This means users who maintain data in the RIPE Whois Database can store certificates issued from any certificate authority (CA), and users who get a certificate from the LIR Portal can have the LIR Portal add the certificate on their behalf.

  The key-cert object uses the same authorisation rules that were already present in the RIPE Database. The object supports S/MIME e-mail, which is the standard for using X.509 certificates to sign e-mail. This allows updates to be authenticated with the X.509 key-cert objects. In addition, users can use their client-side certificates to authorise updates to the database using “webupdates” and “syncupdates”.

• NONE deprecation

  Support for the "NONE authentication scheme" was removed from the database in April 2004.

  The RIPE Whois Database used to have a mechanism whereby maintainers could explicitly choose to not require authentication. However, because this could allow the hijacking of IP address space, the community proposed that this mechanism be removed.

  All maintainers that had the NONE scheme were modified and given a unique password. All objects that referenced a special "well-known" maintainer with the NONE scheme were also modified.

Organisation Object

Any object in the database can reference an organisation by a new attribute, and some query changes were made to allow users to find all of the objects that an organisation is referenced in.

Organisation objects were created for each RIR (APNIC, ARIN, LACNIC, and the RIPE NCC), the IANA, and for each RIPE NCC LIR. Additionally, every IPv4 and IPv6 allocation had a reference to the appropriate LIR added to it.

RPSLng

RPSL, a language used to describe a routing policy, is supported by the RIPE Database. RPSLng is an IETF effort to extend RPSL so that IPv6 and multicast may be defined. Support for RPSLng was added to the RIPE Database in December 2004.

Other Changes

The database had a number of other relatively minor changes throughout 2004. A complete archive of announcements about these changes, which include the details of each, can be found at the Whois Database News Archive:

http://www.ripe.net/db/news/index.html

User Support

The RIPE NCC also offers support for database users. Part of this support is given by the database e-mail help desk, RIPE DBM. The RIPE DBM can be contacted by any user of the RIPE Database at: ripe-dbm@ripe.net.

In 2004, a full-time User Support Specialist was added to the staff to provide increased support for users.

5.4 DNS Services

To further improve reliability and robustness of the name servers the RIPE NCC deployed more name servers in 2004. Currently the RIPE NCC provides secondary DNS for ccTLDs, and primary and secondary DNS service for reverse domains.

Reverse Delegation

As part of member services, the RIPE NCC provides reverse domain delegations for allocated IPv4 and IPv6 address space. This remains the primary DNS activity carried out by the RIPE NCC.

The RIPE Whois Database is now used as the authoritative source for the reverse zones.
This is as a result of the RDNS project, which provides LIRs with a way to maintain their reverse domains in line with other interfaces they use to interact with the RIPE NCC.

More details about the reverse delegation is available at:

http://www.ripe.net/reverse/

Secondary DNS

The provision of secondary DNS services forms an important part of the service to ensure the reliability and robustness of the general DNS infrastructure. The RIPE NCC provides the secondary DNS service to any ccTLD organisation that requests it. The RIPE NCC offers this service free of charge. At the end of 2004, the RIPE NCC was providing a stable secondary DNS name service to 109 country code Top-Level Domains (ccTLDs).

K-Root

The RIPE NCC operates the K-root server, one of the 13 root name servers in the world. These root name servers are a crucial part of the Internet DNS infrastructure. The RIPE NCC has operated the K-root server since 1997 when the first server was installed at the London Internet Exchange (LINX) in London, UK. In 2003, the RIPE NCC deployed the first anycast instance at the Amsterdam Exchange (AMS-IX) as described in ripe-268.

During 2004, the RIPE NCC expanded the anycasted cloud of K-root deploying instances with limited reachability in the RIPE NCC service region. The main objective of this effort is to improve local service quality to the K-root server for a significant local ISP community. In addition, it isolates the impact of an "external" Denial of Service (DoS) attack and localises the impact of a "local" DoS attack.

A detailed plan, along with a call for expressions of interest to host a mirror instance of K-root, was presented in September 2003. In addition to the two globally reachable nodes in London (LINX, XPE) and Amsterdam (AMS-IX, NL-IX, XPE), the K-root server is now locally available in Frankfurt (DE-CIX), Athens (AIX), Doha (QTEL), Milan (MIX), Reykjavik (RIX), Helsinki (FICIX), Poznan (PSNC), Geneva (CIXP) and Budapest (BIX).

New instance of RIPE NCC K-root server deployed at the DE-CIX in Frankfurt, January 2004.

Since August 2004, the K-root server is also IPv6 transport enabled on one of the global nodes located in Amsterdam. It is answering on IPv6 address 2001:7fd::1 and is connected to two Internet Exchanges: AMS-IX and NL-IX.

More information can be found at:

http://k.root-servers.org

Hostcount

Since the beginning of 1992, the RIPE NCC region Hostcount has been performed to indicate the growth in the RIPE NCC service region. As of October 2004, the amount of hosts registered in the RIPE NCC service region was around 22.3 million. This represents an increase of approximately 1.2 million (6%). The growth and amount of data to process led to a project to redesign the Hostcount. This is currently in progress and will lead to a better, faster and more maintainable setup.

More information about the RIPE region Hostcount is available at:

http://www.ripe.net/info/stats/hostcount/

5.5 Test Traffic Measurements Service

The Test Traffic Measurements Service (TTM) is designed to reliably and impartially measure end-to-end performance characteristics of the inter-provider Internet. This is achieved by installing test-boxes at participating sites. These test-boxes send measurement traffic to each other. From this traffic, packet-losses, delays and other parameters are determined according to the metrics developed by the IETF IP Performance Working Group (IPPM WG). In 2004, the RIPE NCC continued to actively participate in this working group, with one of its staff members acting as the co-chair.

In 2004, 22 new test-boxes were sold. This is about the same as the year before. In 2004, the TTM service fee was lowered and the data disclosure policy changed. However, neither of these factors seem to have had a significant effect on the number of boxes sold. The RIPE NCC continued to actively promote the service at RIPE Meetings and other relevant meetings.

As the number of IPv6 networks continues to grow, so does the number of test-boxes doing measurements on both IPv4 and IPv6 networks. During the year, it grew from 21 sites in January 2004 to 30 in December 2004. At the moment, many of the IPv6 networks are connected to each other by means of tunnels over IPv4 networks. These tunnels can have significant effects on the performance of a network. Various techniques to infer the existence of tunnels in IPv6 paths exists. An overview can be found at:

http://web.dia.uniroma3.it/ricerca/rapporti/rt/2003-82.pdf

In 2004, the RIPE NCC added software to the test-boxes that use one of these techniques to detect tunnels and present the result to operators.

During the year, the RIPE NCC studied the possibility of routinely measuring capacity and available bandwidth between test-boxes using non-intrusive tools. While considerable progress has been made in this field in the past two years, the conclusion was that none of the tools currently available are suitable to routinely do a large number of measurements. The RIPE NCC therefore decided to abandon this route and look for other methods of bandwidth measurement.

The IPPM WG finished the “One-Way Active Measurement Protocol” (OWAMP) and the RIPE NCC started investigating how this can be added to the TTM software. This work will continue in 2005.

At RIPE 48, several presentations were given showing operators how TTM data can be used to debug problems in practice. These presentations received very positive feedback. During 2004, the RIPE NCC collaborated with several university and corporate research groups on the analysis of the TTM data. Other research projects were carried out independently of the RIPE NCC using data collected by the TTM service. Links to published papers can be found on the TTM site.

http://www.ripe.net/projects/ttm/Documents/Various/

It has become clear that making the raw TTM data available is a useful service for research purposes and for the ISP community.

More information about the RIPE NCC Test Traffic Measurements Service can be found at:

http://www.ripe.net/ttm

5.6 Routing Information Service

The Routing Information Service (RIS) has been established to collect inter-provider routing information at various points in the Internet infrastructure in near real-time. The information is time-stamped and stored in a database. In 2004, the RIPE NCC focused on providing a stable service, increasing the number of collection points and peers, and the development of additional products based on the collected data.

Remote Route Collectors (RRCs) are being used to collect data for the RIS. In 2004, two more RRCs were deployed, at the NYIIX (New York, USA) and DECIX (Frankfurt, Germany) while work is in progress to install collectors at the PAIX (Palo Alto, USA) and MSK-IX (Moscow, Russia). This will bring the total number of RRCs to 13.

The number of peering sessions grew from 333 in December 2003 to 415 in December 2004. This includes 51 IPv6 sessions. During 2004, the usage of the RIS website almost doubled, from 16,000 visitors/month downloading 360,000 pages in December 2003, to 30,000 visitors/month downloading 570,000 pages in November 2004.

The two main new products based on the RIS data introduced in 2004 were the MyASn tool and the BGPlay visualisation system. Development of the RISwhois tool described in the RIPE NCC 2003 Annual Report was completed.

The objective of MyASn is to devise a control/notification system for BGP route propagation in near real-time, which allows users to specify expected paths and other attributes from peers with the RIS. If a deviation in routing information is detected, the user will be notified of that deviation. A prototype of the MyASn tool was shown at RIPE 46. During 2004, the prototype was turned into a full product and released at RIPE 49. For more on MyASn, see:

http://www.ris.ripe.net/myasn.html

BGPlay is a Java application that displays animated graphs of the routing activity of a certain prefix within a specified time interval. Its graphical nature makes it much easier to understand how BGP updates affect the routing of a specific prefix than by analysing the updates themselves. For more on BGPlay, see:

http://www.ris.ripe.net/bgplay/

BGPlay was designed and written by the Computer Networks Research Group at Roma Tre University, and integrated with the RIS during a nine month visit by one of the authors to the RIPE NCC.

The RIPE NCC also collaborated with several university and corporate research groups on the analysis of the RIS data. Other research projects were carried out independently of the RIPE NCC using the raw BGP data collected by the RIS. A full overview of published papers can be found at:

http://www.ripe.net/projects/ris/docs/analysis.html

In May 2004, the RIPE NCC organised a workshop on Inter Domain Routing (IDRWS), in collaboration with Intel Research, the Technical University of Munich, the University of Karlsruhe and Schlund and Partners AG.

http://www.tm.uka.de/idrws/index.php?year=2004

About 25 representatives from industry and research met for two days and discussed future directions in routing research and applications of the RIS data. Later in the year, RIPE NCC staff attended and contributed to various conferences in the networking field, such as IMC2004, SIGCOMM, PAM2004 and others.

More information about the RIS can be found at:

http://www.ripe.net/ris

5.7 Deployment of Internet Security Infrastructure

The Deployment of Internet Security Infrastructure project (DISI) continued to focus on the security of the Domain Name System and deployment of DNSSEC.

Within the context of deployment of DNSSEC the RIPE NCC focused on protocol development and operational issues of DNSSEC. The RIPE NCC continued collaboration with Miek Gieben from NLnet Labs to document the operational issues specific to DNSSEC. The RIPE NCC also collaborated with Johan Ihren (Autonomica AB) and Bill Manning (EP.net) on a document describing an in-band rollover mechanism for DNSSEC keys.
Current versions of these documents are available from:

http://www.ietf.org/html.charters/dnsop-charter.html

http://www.ietf.org/html.charters/dnsext-charter.html

As part of the DISI project mission to provide white papers and tutorials that help to ease deployment, the RIPE NCC updated its DNSSEC "HOWTO" to be compliant with the protocol description and software. This document is available from the DISI website:

http://www.ripe.net/disi

Olaf Kolkman, Systems Architect at the RIPE NCC, has been acting as co-Chair of the IETF DNSEXT Working Group and has been active in an international collaboration that co-ordinates DNSSEC deployment.

To prepare for DNSSEC deployment, the RIPE NCC restructured its reverse DNS setup. This project involved modification of internal databases so that the RIPE Whois Database became the authoritative source for zone file generation; the introduction of a new attribute that allows for delegation of authority for creating delegation; a simplification of the reverse delegation policy (ripe-302); and a cleanup of inconsistencies between data in the Whois database and the zone files.

More information about the RIPE NCC’s reverse delegation policy is available at:

http://www.ripe.net/ripe/docs/rev-del.html

The RIPE NCC continued to maintain the Net::DNS::SEC Perl module and developed a Net::DNS::Zone::Parser module both available through CPAN:

http://search.cpan.org/~olaf/

5.8 DNS Monitoring Service

The DNS Monitoring (DNSMON) project was triggered by various publications claiming that all root name servers had become unreachable during one of the worm incidents in 2003. Detailed reading showed that these studies suffered from two major flaws:

• Measurements originated from one site only;
• ICMP instead of DNS traffic was used.

This means that rate-limiting filters or problems near the measurement location can give misleading impressions on the availability of the root name servers. To provide a meaningful and comprehensive view, an alternative monitoring tool was needed.

A prototype of DNSMON was developed in 2003. DNSMON uses TTM test-boxes to provide an objective and up-to-date service overview of DNS root and participating Top-Level Domain (TLD) name servers. The measurements show the reachability of root servers and are presented such that the user can distinguish between server-side and client-side problems. During 2004, the prototype was turned into a production level service. The DNSMON site is available at:

http://dnsmon.ripe.net

During the year, it became clear that TLD operators were interested in value added services such as the monitoring of specific name servers and access to a DNSMON helpdesk. The RIPE NCC decided to provide this service for an additional cost recovery fee. The document describing the service was discussed with the community and will be finalised early in 2005.

5.9 ENUM

The RIPE NCC runs the Tier 0 Registry for the e164.arpa domain on behalf of the Internet Architecture Board (IAB). ENUM is the Internet Engineering Task Force (IETF) standard as described in RFC2916 to map telephone numbers into the DNS according to the International Telecommunication Union (ITU) standard E.164. ENUM will help the Internet and the telephony world converge by enabling each system to address the other.

“E.164 number and DNS” (RFC2916) and the E.164 standard can be found at:

ftp://ftp.rfc-editor.org/in-notes/rfc2916.txt
http://www.itu.int/rec/recommendation.asp?type=folders&lang=e&parent=T-REC-E.164

The RIPE NCC follows the IAB instructions to provide DNS name service for e164.arpa. The instructions can be found at:

http://www.ripe.net/enum/instructions.html

The RIPE NCC delegates E.164 country codes to requesting entities (i.e. the Tier 1 Registries) after approval by ITU Telecommunication Standardization Sector - Telecommunication Standardization Bureau (ITU-T TSB). The e164.arpa domain is the root of the ENUM namespace in the global DNS. ITU-T TSB handles delegation requests following the ITU-T - Study Group 2 (ITU-T SG2) Interim Procedures. More information can be found at:

http://www.itu.int/ITU-T/inr/enum/procedures.html

In 2004, the RIPE NCC processed eight requests for delegation of eight E.164 country codes. There are now 25 delegations under the e164.arpa domain: 23 country codes and two non-geographical codes.

More details can be found at:

http://www.ripe.net/enum/

6.0 RIPE

RIPE (Réseaux IP Européens) is a collaborative forum open to all parties interested in wide area IP networks. The objective of RIPE is to ensure the administrative and technical co-ordination necessary to enable the operation of the Internet. There are no membership requirements for participation in RIPE; activities are performed on a voluntary basis and decisions are formed by consensus.

The work of the RIPE community is carried out within a variety of working groups. Each of these RIPE Working Groups has one or more mailing lists where relevant topics are discussed. The RIPE community is the most important source of public input for the RIPE NCC and also plays a significant role in the development of the RIPE NCC annual activity plan.

Policies regarding IP administration are created within RIPE, in particular the Address Policy Working Group. The RIPE NCC does not set policies but ensures the consistent application of policies within its service region.

More information about RIPE Working Groups is available at:

http://www.ripe.net/ripe/wg/

RIPE Meeting Support

Although two distinct entities, RIPE and the RIPE NCC are interdependent in their operations.

The RIPE NCC is committed to supporting the bottom-up, industry self-regulatory structure developed by the RIPE community. As an integral part of this structure, the RIPE NCC provides administrative support for RIPE and facilitates the organisation of RIPE Meetings.

RIPE Meetings

This includes the webcasting of selected sessions and feedback mechanisms that allow RIPE NCC members and the Internet community not at the meeting to follow important discussions. The mediums used for this were Internet Relay Chat (IRC) and Jabber.

As announced by Rob Blokzijl, RIPE Chair, two RIPE Meetings will be held in 2005. Based on the feedback from the community, this schedule may continue in 2006. The RIPE NCC will offer additional support to RIPE Working Groups to facilitate discussion and progress between RIPE Meetings.

As decided by the RIPE community at the RIPE 48 Meeting, the ENUM Working Group was created in May 2004.

More information about RIPE Meetings can be found at:

http://www.ripe.net/ripe/meetings/

7.0 RIPE NCC in the Internet Industry

In 2004, the RIPE NCC continued to support and represent the interests of its membership and the RIPE community to Internet industry groups and government. The main goal of these outreach activities remains the promotion of the open, bottom-up, industry self-regulatory structure common to all Regional Internet Registry (RIR) communities in managing Internet address resources.

The RIPE NCC represents the interest of its members and the RIPE community by actively participating in various industry-related forums and meetings. In 2004, the RIPE NCC responded to topical issues brought forward by the industry that included the migration to IPv6, the introduction of ENUM services, and the World Summit on Information Society (WSIS).

The RIPE NCC and the other RIRs have been actively involved in the WSIS from the first phase of the summit in Switzerland (December 2003), through the PrepCom 1 in Tunisia (June 2004) and the regional meeting in Syria (November 2004). The RIRs will continue to represent the needs of their members and communities throughout 2005 at the PrepCom 2, to be held in Switzerland, the regional meetings in Ghana and Brazil, and the second phase of the summit to be held in Tunisia in November 2005. In addition, the RIPE NCC and the other Regional Internet Registries, acting together through the Number Resource Organization (NRO), have been active participants in the Working Group on Internet Governance (WGIG).

The NRO has offered a number of public responses on behalf of the Regional Internet Registries and their communities, and these responses have been well supported by both RIPE NCC members and industry partners.

The NRO issued a response to an ITU proposal to create a new IPv6 address space distribution process based on national authorities. The NRO response corrected the proposal’s assumptions about IP address distribution, detailed the flaws of the proposal and described the negative impact that the proposal would have on Internet operations. The NRO response was well supported by RIPE NCC members, with almost nine hundred explicit expressions of support from members based in more than 60 countries in the RIPE NCC service region. There were also more than 20 explicit expressions of support from ITU-Sector members.

RIPE NCC Outreach Activities

Building on its position as a neutral, credible and authoritative organisation, in 2005 the RIPE NCC will continue to develop relations with a growing community of stakeholders, industry bodies and government representatives. The RIPE NCC will maintain its outreach efforts to explain the proven, long-standing industry self-regulatory structures of the Regional Internet Registries and secure continued support for the existing registry process. These outreach activities will include RIPE NCC roundtable events that will include representatives from government, industry partners, the ICANN Governmental Advisory Committee (GAC) and ITU Sector members. The RIPE NCC will focus these efforts on developing new contacts and communicating the principles of Internet industry self-regulation to policy makers, both in the public and the private sector. For the Internet community, it is vital that government, industry and regulators have an informed understanding of how Internet address space management and distribution works, and why it has proved so successful.

RIPE NCC and AfriNIC

The RIPE NCC and the other RIRs have continued to strongly support AfriNIC in its progress towards being recognised as an RIR by ICANN.

The RIPE NCC has offered substantial and direct support to AfriNIC including hosting AfriNIC staff members at the RIPE NCC offices so that they can experience the day-to-day activities of its various departments and to gain experience from an established RIR.

As part of the transition process, AfriNIC and the RIPE NCC have been co-evaluating resource requests since 1 September 2004.

AfriNIC was provisionally recognised by ICANN in October 2004 and is expected to become a fully recognised RIR in 2005.

The Address Supporting Organization

In October 2004, the NRO, on behalf of the RIRs, signed a Memorandum of Understanding (MoU) with ICANN on the Address Supporting Organization (ASO). This MoU describes how the NRO will fulfil the role, responsibilities, and functions of the ASO. The MoU also outlines a policy process that promotes industry self-regulation of the unallocated number resource pool (IPv4, IPv6, and AS Numbers). In 2005, the RIPE NCC, together with the other RIRs, will finalise the process for an ASO governed by the new MoU. The focus here will be on making the transition phase as stable as possible.

ASO Address Council (AC) elections were held at the RIPE 49 Meeting in Manchester, United Kingdom, where Hans Petter Holen was re-elected. The three AC members from the RIPE NCC service region in 2004 were:

• Sabine Jaume-Rajaonia
  (RENATER, France)

• Hans Petter Holen
  (Visma IT AS, Norway)

• Wilfried Woeber
  (Vienna University, Austria)

The RIPE NCC performed the secretariat function for both the ASO and the NRO in 2004. This included maintaining all necessary web pages, documents and mailing lists. The secretariat function rotates between the RIRs on an annual basis, and will be performed by LACNIC in 2005.

K-root and DNS Monitoring

As the organisation responsible for operating the K-root server, the RIPE NCC continued to deploy anycast instances throughout 2004. In 2004, the RIPE NCC helped make Internet history when, for the first time, the number of instances of DNS root servers outside the United States exceeded the number within. The balance was tipped by the launch in Frankfurt of an anycast instance of the RIPE NCC operated K-root server in January 2004.

Deployment of anycast instances of the K-root server further improves the distribution of this crucial service in various Internet regions and its resilience against Distributed Denial of Service (DDoS) attacks. As K-root is one of the 13 root servers, this also means improvement for the whole root server system.

RIPE NCC technicians were among the pioneers of the anycast concept for root servers and have deployed 12 instances of the K-root server, with nine of these deployments taking place in 2004.

As requested by the RIPE community, the RIPE NCC will continue to monitor the quality of the root name service and make the results publicly accessible through the RIPE NCC DNS Monitoring site. In addition, in 2005 a value added paid service will be offered to ccTLD administrators.

Financial Report 2004

Notes to the RIPE NCC Statement of Income and Expenditure 2004

General

All amounts are expressed in kEUR. Foreign currencies are converted at the daily exchange rate at the date of transaction or valuation. The balance sheet has been prepared in accordance with the historical cost convention. The accounting principles have been in accordance with previous accounting years, with the exception of the valuation of outstanding vacation days. These have been valued at 122 kEUR.

The financial year 2004 resulted in a surplus of 2,698 kEUR. This positive result is due to a higher than expected income from membership growth and the effective control of expenses. This surplus increases the RIPE NCC reserves almost up to the level equivalent with one year's operating expenses for the RIPE NCC. This target has been set by the Executive Board and the RIPE NCC Management for the financial stability and the continuity of the RIPE NCC.

Revenues

Revenues were 5% below 2003 and 15% above the budgeted income for 2004. The income from service fees in 2004 was less than in 2003 due to a substantial decrease in fees versus 2003, although there was a countering positive effect due to increased new membership. The total membership increased to 3,824, a 10% growth compared to 2003. The total number of new members applying in 2004 was 635. Due to closed members and applicants that never became full members, the net growth for 2004 was 336 members. The RIPE Meeting fees income was on the same level as in 2003 but well below budgeted income. This is a result of lower than expected attendancy at the RIPE Meetings. Other income contains TTM Service fees and payments of written off accounts from previous years. Due to lower TTM Service fees, other income in 2004 was lower than in 2003.

Expenditures

Total expenditure in 2004 was 3% less than total expenditure in 2003. The main cause for the decrease in expenditure was a decrease in depreciation expenses due to an efficient, formalised purchase process and a change in the depreciation term for hardware purchases from 2 years to 3 years. Personnel expenses increased slightly from 2003 but were still well below the budget 2004. In 2004 an additional accrued item for outstanding employee vacation days of 122 kEUR is included. For the full year 90.5 FTE were employed compared to 97.4 FTE for the year 2003. Operational expenses increased due to the two Regional Meetings held in 2004, additional postage expenses for the mailing of the Standard Service Agreements and increased ICANN contribution for 2004.

Miscellaneous expenses consist of bad debts and Personnel Fund expenses. Bad debts were 361 kEUR in 2004, almost 50% lower than in 2003 due to fewer closures and lower fees. The liability to the Personnel Fund was 330 kEUR for 2004, substantially higher than 2003 as a result of more employees with indefinite contracts. Financial expenses include bank charges and interest received on the current and deposit accounts. From the larger cash deposits increased interest was received over 2004.

Notes to the RIPE NCC Balance Sheet as per 31 December 2004

General Information

All amounts are expressed in kEUR. Foreign currencies are converted at the daily exchange rate at the date of transaction or valuation.

Historic costs have been used throughout unless otherwise stated.

Assets are valued at historical costs and are depreciated on a straight-line basis, starting in the month after acquisition. Computers consist of hardware and activated software. Hardware is written off in three years while software is written off in two years. Infrastructure is written off in three years and office equipment in five years. All items under EUR 1,000 are expensed.

Current Assets

Accounts receivable increased in comparison with 31 December 2003 due to the increase of new members and the late sending of quarterly- and half-yearly invoices.

In 2004 suspense accounts are stated as accounts receivable. Suspense accounts are payments received from members of which the origin of the payment is not yet clear. Therefore these are corrected versus the accounts receivable.

Miscellaneous receivable include prepayments for rent, equipment, pension, health and deposits for RIPE Meeting venues. Other items listed under miscellaneous receivable are interest receivable, fees to be received, payments in transit and long-term receivables. In addition, miscellaneous receivables includes for 2004 an inventory for the sale of K-root and TTM equipment.

Capital

Up to 1998, surpluses have been accumulated in the RIPE NCC reserves. In 1998, the RIPE NCC agreed with the Dutch tax authorities on a tax ruling that allows surpluses to be put tax free into a Clearing House. All yearly surpluses since 1998 have been allocated to the Clearing House. In 2004 the Clearing House ruling with the tax authorities was revised so that the Clearing House applied to the members as a group and not individually. This was approved by the General Meeting in May 2004. Currently the maximum reserve in the Clearing House is limited to 3 times the service fees received from the members.

Current Liabilities

Unearned revenues

The unearned revenues consist of invoices sent in 2004 but pertaining to 2005. The substantial decrease in Service Fees for the year 2005 has resulted in a moderate decrease even though the membership grew considerably over the year 2004.

Over the course of 2004 the RIPE NCC changed the wage tax filing period from quarterly to monthly. Therefore at year end the December payment was still due.

In comparison to 2003, miscellaneous payable includes one additional item, the accrued vacation days for the employees. This is based on the number of outstanding vacation days at 31 December 2004 valued at the December 2004 salary. Other payables include the unearned revenue for African registries of 201 kEUR. Upon receipt of payment the amount will be transferred to AfriNIC in 2005.

Items Not Shown in Balance Sheet

The RIPE NCC rents office space in two buildings and has four separate rental agreements for these. Four bank guarantees have been issued for an amount of 135 kEUR to cover a quarter of the rent of the office space. Currently all these rental agreements are under negotiation.

To the General Meeting and
Executive Board of the
RIPE NCC Association
Singel 258
1016 AB Amsterdam

Auditor’s Report

Introduction
We have audited the financial statements of Réseaux IP Européens Network Coordination Centre (RIPE NCC), Amsterdam, for the year 2004. These financial statements are the responsibility of the management of the association. Our responsibility is to express an opinion on these financial statements based on our audit.

Scope
We conducted our audit in accordance with auditing standards generally accepted in the Netherlands. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audit provides a reasonable basis for our opinion.

Opinion
In our opinion the financial statements give a true and fair view of the financial position of the association as at 31 December 2004 and of the result for the year then ended in accordance with accounting principles generally accepted in the Netherlands.

Amsterdam, 8 March 2005

M.H.P. van Winsen
Registeraccountant