[ncc-services-wg] Discrepancy between WHOIS and delegated-ripencc

Hi Peter,

probably I know the answer.

The first network was registered through our LIR, which is located in Czech republic. The
regid of LIR is cz.netart. It seems that quoted file contains the value of LIR country as
country field.

Whois data is more reliable. I told this several times to many GeoIP providers.




Friday, November 5, 2010, 7:24:46 PM, you wrote:

PK> Hello!

PK> This might not be the appropriate place for my question; if that is so, I
PK> apologize in advance.

PK> I've noticed that the data provided by the RIPE WHOIS database is 
PK> sometimes inconsistent with the data shown in the delegated-ripencc-latest 
PK> file, available from the ftp://ftp.ripe.net/ripe/stats/ server. For 
PK> example, consider these two entries:

PK> -------------------------------------------------------
PK> $ whois 91.212.135.0/24

PK> inetnum:        91.212.135.0 - 91.212.135.255
PK> netname:        YABA-NET
PK> descr:          YabaMedia Ltd
PK> country:        RU

PK> $ grep 91.212.135.0 delegated-ripencc-latest
PK> ripencc|CZ|ipv4|91.212.135.0|256|20090409|assigned
PK> -------------------------------------------------------
PK> $ whois 193.105.207.0/24

PK> inetnum:        193.105.207.0 - 193.105.207.255
PK> netname:        ALFAHOSTNET
PK> descr:          Alfa-host LLP.
PK> country:        KZ

PK> $ grep 193.105.207.0 delegated-ripencc-latest
PK> ripencc|CZ|ipv4|193.105.207.0|256|20100315|assigned
PK> -------------------------------------------------------

PK> As you can see, the data differs in the "country" field -- in both cases, 
PK> the range is attributed to Czech Republic, while the block is actually 
PK> assigned to anothers.  Since the delegated-ripencc-latest file is used by 
PK> some reputable and often-used sources (like Team Cymru; 
PK> http://www.team-cymru.org/Services/ip-to-asn.html), this can sometime 
PK> result in misleading and completely useless reports (as you can probably 
PK> guess, it was Czech Republic getting unfair load of hostile sites 
PK> attributed to it).

PK> There are two questions now:
PK> 1) What is the source of this discrepancy?

PK> 2) If it was caused by some kind of an error, can the databases be put in
PK>     sync? If it is intentional, which source is more "reliable"?

PK> Thanks,

PK> Peter




--
Sergey