[ncc-services-wg] Discrepancy between WHOIS and delegated-ripencc

Dear Peter

The "country:" attribute in the RIPE Database can be set by the resource
Holder to any valid, international country code. It has little meaning
to anyone other than the resource Holder. Only they know what they had
in mind when they set it. To explain the problem simply, it could be the
country where the resource Holder is physically located, or the country
of a data centre or the country where the resource is being used. This
has been discussed a few times at RIPE Meetings but no consensus has
been reached on a strict definition of this attribute.

The RIPE NCC has just published an article on RIPE Labs about an idea to
separate some of the registration data in the RIPE Database into two
parts. A fixed part containing data supplied to the RIPE NCC by the
resource Holder and another part with data the resource Holder can
change at any time. In the prototype we have included "country:" in both
parts of this data. The intention is to have a strict definition of what
'country' means from a registration perspective in the fixed part of the
data.

https://labs.ripe.net/Members/Paul_P_/a-new-ripe-database-prototype

I hope this helps.
Regards
Denis Walker
Business Analyst
RIPE NCC Database Group



Peter Kosinar wrote:
> Hello!
>
> This might not be the appropriate place for my question; if that is so, I
> apologize in advance.
>
> I've noticed that the data provided by the RIPE WHOIS database is
> sometimes inconsistent with the data shown in the
> delegated-ripencc-latest file, available from the
> ftp://ftp.ripe.net/ripe/stats/ server. For example, consider these two
> entries:
>
> -------------------------------------------------------
> $ whois 91.212.135.0/24
>
> inetnum:        91.212.135.0 - 91.212.135.255
> netname:        YABA-NET
> descr:          YabaMedia Ltd
> country:        RU
>
> $ grep 91.212.135.0 delegated-ripencc-latest
> ripencc|CZ|ipv4|91.212.135.0|256|20090409|assigned
> -------------------------------------------------------
> $ whois 193.105.207.0/24
>
> inetnum:        193.105.207.0 - 193.105.207.255
> netname:        ALFAHOSTNET
> descr:          Alfa-host LLP.
> country:        KZ
>
> $ grep 193.105.207.0 delegated-ripencc-latest
> ripencc|CZ|ipv4|193.105.207.0|256|20100315|assigned
> -------------------------------------------------------
>
> As you can see, the data differs in the "country" field -- in both
> cases, the range is attributed to Czech Republic, while the block is
> actually assigned to anothers.  Since the delegated-ripencc-latest
> file is used by some reputable and often-used sources (like Team
> Cymru; http://www.team-cymru.org/Services/ip-to-asn.html), this can
> sometime result in misleading and completely useless reports (as you
> can probably guess, it was Czech Republic getting unfair load of
> hostile sites attributed to it).
>
> There are two questions now:
> 1) What is the source of this discrepancy?
>
> 2) If it was caused by some kind of an error, can the databases be put in
>    sync? If it is intentional, which source is more "reliable"?
>
> Thanks,
>
> Peter
>