[anti-abuse-wg] Bye Bye

Repost as my other email address wasn't subscribed to the list. 

-----Original Message-----
From: Erik Bais [mailto:ebais at a2b-internet.com] 
Sent: zaterdag 29 juni 2013 12:57
To: 'Marco d'Itri'; anti-abuse-wg at ripe.net
Subject: RE: [anti-abuse-wg] Bye Bye

Hi Marco, 

> > With some majors like Google starting to adopt it, and with only a few
> > years left for a v4 aftermarket, carrier grade nat etc to have any effect,
> There is no noticeable v4 market and NAT is only relevant on the access 
> side. I don't do access.

I have to disagree with you, there IS a v4 market .. and people are already in pain or are looking at how to fix their issue. 

Going native v6 isn't the fix for most of them, a majority of the LIR's NEED to run dual-stack for a noticeable time ahead. 
Not because they can't run native v6, but because others don't run v6 at all. 
Carrier Grade Nat (CGN) will break stuff in certain scenario's like VOIP, some streaming video's, Xbox live connectivity and will cost you a lot in storage for (abuse) logging. 
You will require boxes that aren't cheap either.. and in order to be able to pinpoint that one customer that did a spam-run or portscan (as an example) you will need to know exactly who used IP X, tcp ports range Z to Y at timestamp. 

And with the current EU Data Retention Act, you may be forced to store that information between 6 months to 24 months for legal reasons. (your mileage may vary depending on the country you work in ) 
To give you an indication, a 1 milj. subscriber LIR, will generate per subscriber about 5 to 96 Mb of logs per day (just headers from the CGN) that is about 1Pbyte storage per 1M subscribers .. per month ..

 - http://pc.denog.de/system/attachments/5/original/07-Grundemann-Carrier_Grade_NAT.pdf?1353317223  See this very nice presentation from CableLabs about CGN from Denog4 in November 2012. 

To give an indication, 1 Pb of storage will cost you about 6 racks filled with disks, setting you back only in colocation cost about 5k US$ and roughly an equal amount in power cost per month. 
So keeping it online alone will have an operating cost of 10k US$, not including cost of purchase of the storage or management of the information on it. 

So if you, for instance in my case, live in the Netherlands, you NEED to store the information 12 months. Does that give enough background about why people are looking into the IPv4 market ? 

The reason why people tend to say there is no v4 market, is not because it is not here ... it is because the transfer policy is currently for a lot of companies to restrictive. 
This results in movement of IP ranges not being updated in the actual registry. Think about PI IPv4 being sold, but not transferred in ownership to the new 'owner' 
Why ? Because the transfer policy doesn't allow for PI transfers... So sometimes  a side letter is made, money is provided and things stay as it is in the registry. Sometimes it is even sold, without such a letter I've seen. 

The 24 month cool-down period for a range after a transfer ? Come on, if money is to be made, it is foolish to think that people will take the high road and sit on their resources. 
The current policies don't state that you can't move an LIR between legal entities ... or just buy the complete legal entity that holds the LIR. (stock transfers) 

There IS a market and people DO relocate resources in the above mentioned ways... Wake up and smell the new reality. 

The more restrictive and difficult the policies are, the more creative people will become. 
Should it be frowned upon ? Perhaps, but most of the people doing it, don't care if someone would ask them why they would do it. Especially if serious money is to be made (or if they can proceed signing up customers in the years to come) 

WE as a community should make the transfer policies as transparent as possible to make sure that the registry is up to date, because it is not possible to restrict transfers. 

By maintaining all these transfer limitations, we will not prevent the transfers, the registry will not be up to date AND if people that have a v4 surplus will move their resources to people who want to compensate the current owners for it, so be it. At least the un-used IP's get used by those that are willing/able to put money on the table for it.  

The RIPE NCC did a great job in the past in fair distribution, but their role isn't in distribution anymore, it is to keep the registry up to date. That is their #1 role for the future. 

Sorry for the long reply, but people who still think that there is no v4 Market haven't paid much attention to what is happening around them. 
See also the growing list of transfers on the RIPE website: https://www.ripe.net/lir-services/resource-management/ipv4-transfers/table-of-transfers 

Regards,
Erik Bais