On IPv4 transfer markets: Analyzing reported transfers and inferring transfers in the wild

Abstract

IPv4 Transfer Markets have recently emerged as a mechanism for prolonging the usability of IPv4 address space. They facilitate the trading of IPv4 address space, which constitutes a radical shift transforming IPv4 addresses from a free resource to a commodity. In this paper, we conduct a comprehensive analysis of all IPv4 transfers that are published by three regional Internet registries. We analyze the overall evolution of transfer markets, whether they lead to a healthy redistribution of IP addresses, and the interplay between transfers and IPv6 adoption. We find that, to a large extent, IPv4 transfers serve their intended purpose by moving IP blocks from those with excess to those in need - transferred address blocks appear to be routed after the transfer, the utilization of transferred blocks is greater after the transfer date and a high percentage of the transferred space comes from legacy space. We have also proposed a methodology for detecting IPv4 transfers in the wild that tracks changes in origins of IP prefixes in the global routing table. This method yields promising results, yet it produces a large number of false positives due to the noisy nature of routing data. We have investigated the cause of these false positives and verified that they can be reduced to a volume analyzable by a human operator.

Introduction

In the course of the last few years we have witnessed a rapid decrease in the number of available IP version 4 (IPv4) addresses. Currently, four of the five Regional Internet Registries (RIRs) are allocating from their last /8 address block, which is the last 2²⁴ addresses that a RIR has at its disposal [1], [2], [3], [4]. Moreover, the American Registry for Internet Numbers (ARIN) reported in September 2015 that it has no more available IPv4 addresses [5]. The Internet community foresaw this problem and designed a new version of the IP protocol, IP version 6 (IPv6) [6], which considerably extends the IP addressing space (i.e., from 2³² to 2¹²⁸ IP addresses). Even though this version was standardized more than 20 years ago, its uptake has been slow [7], [8].

The continuing demand for IPv4 addresses and the slow transition to IPv6 have resulted in organizations looking for other means to fulfill their IP addressing needs. One such mechanism is the IPv4 Transfer Market, which facilitates the sale of IPv4 addresses between organizations with excess (sellers) and organizations with deficit (buyers) of IPv4 address space. IP address trading between these organizations is subject to rules and regulations imposed by the RIRs, which differ from one RIR to another. Buyers and sellers need to submit a transfer request to their local RIR, which decides whether to allow/disallow the transfer based on its internal policies. IPv4 transfer transactions can involve a third-party participant (known as IPv4 broker) that facilitates the process of exchanging the address blocks between a seller and a buyer. Four of the five RIRs have implemented policies that allow transfer of address resources; i.e., Asia Pacific Network Information Centre (APNIC), Réseaux IP Européens (RIPE), American Registry for Internet Numbers (ARIN) and Latin America and Caribbean Network Information Centre (LACNIC). The first intra-RIR transaction was reported by ARIN in 2009. Three years later, the first inter-RIR transaction was reported between organizations registered in North America (i.e., ARIN) and Asia Pacific (i.e., APNIC). The RIRs make the lists of completed transfers available to the public in an attempt to provide more transparency into the address transfer process.

IPv4 transfer markets are a source of controversial discussions [9], [10], [11], [12], [13], [14]. On the one hand, the transfer markets can extend the usable life of IPv4, but they could also delay the adoption of IPv6 or halt it altogether, cause further fragmentation of the address space and larger IPv4 routing tables, or generate destabilizing speculation and/or hoarding behavior. It is not clear that address space owners, especially holders of legacy space, will adhere to RIR transfer policies; even now address blocks may be changing hands without the knowledge of the RIRs. We believe an empirically grounded characterization of address transfer activity will inform the on-going debate on the relative benefits and harms of IPv4 address space markets.

In this work we conduct an empirical analysis of IPv4 transfer markets. In the first part of the paper, we focus on the transferred address blocks published by the RIRs. We characterize these transactions along various dimensions: the type of address space being exchanged on the market, whether that space is subsequently used by the buyers, the organizations involved in the transfers, and the impact of the market on IPv6 adoption and the global routing table. Based on our results there does not appear to be any evidence of a hoarding behavior by the buyers of address space. Most of the address space is routed after the transfer date, and the utilization of transferred address blocks shows an increasing trend after the transfer. We find that 63% of the address space traded on the market represents legacy address space hinting at a healthy redistribution of such space. Our analysis also indicates the existence of a few dominating players that exchange most of the transferred blocks in each region.

In the second part of the paper, we propose a method for inferring transfers “in the wild”. Using routing data generated by the Border Gateway Protocol (BGP), we construct an initial list of candidate transfers based on the observed change in the origin Autonomous Systems (AS) of a prefix over time. A major challenge is that prefixes may change origin ASes for reasons other than transfers, e.g., movements internally within an organization, transient prefix hijacks, and traffic engineering. We devise a set of BGP filters to remove false positives from the list of candidate transfers. Our methodology infers more than 90% of the detectable reported transactions. However, our BGP-based approach also produces a large number of false positive BGP movements. We investigate possible causes of these false positives by analyzing three case studies. We find that many such movements are related to non-BGP speaker organizations, as well as operational changes in the IPv4 address space of the organizations. We also show that leveraging additional data sources, like Domain Name System (DNS) name data and RIR resource allocation records, can further reduce false positives to a level that can be vet by a human operator.

This paper is a longer and more comprehensive version of an earlier work [15]. More specifically, we have extended the measurement period by two years and revised our inferred methodology by investigating the usage of auxiliary data for detecting transfers. We also enhanced the IPv4 transfer market analysis by devising new metrics which offer a deeper understanding of the market. We improved the analysis of the transferred space utilization, involved players on the market and the impact of the market on IPv6 adoption. We also analyzed the impact of the on the global routing table growth, and investigated to what extent the market satisfies the organizations needs for extra IPv4 addresses. Also, we introduced a method for estimating the IPv4 prices and the IPv4 transfer market lifespan. The rest of the paper is organized as follows. Section 2 details the related work. In Section 3 we present a short summary of the IP address management evolution and describe the existing transfer policies implemented by the RIRs. In Section 4 we describe in detail the datasets used in this paper. In Section 5 we analyze the reported transferred address blocks, and in Section 6 we propose a method for inferring transfers using publicly available data. In Section 8 we discuss the implications of our work, and in Section 9 we list our conclusions and avenues for further research.