As the available supply of IPv4 addresses dwindles, the market for these virtual commodities is heating up. In recent months, the pace of the address transfers has greatly accelerated as evidenced by RIPE’s table of IPv4 transfers, as well as the increasing number of IPv4 brokers facilitating the exchange of IPv4 address space. However, the transfer of IPv4 address space isn’t always problem-free and, in this blog, we’ll review this new trend and some of the issues that can arise.
Buying and selling IPv4
In 2011, when Microsoft paid $7.5 million for 666,624 IPv4 addresses as part of the Nortel bankruptcy, observers wondered whether this development would usher in the era of the commercial sale of IPv4 address space. As statistics from European registrar RIPE show, the market may have had a slow start, but we’re in that new era now.
RIPE’s table of transfers of provider aggregatable (PA) IPv4 address clearly shows a rapidly increasing rate of transfers of IPv4 address blocks and unique IPv4 addresses. The following two graphs illustrate the uptick in recent months of address space movement. February 2015 saw the most organizational transfers (373), while November 2014 saw the most unique address transfers (nearly 2 million).
As noted on IPv4 address broker V4Escrow’s blog post from February, the number of transfers in the RIPE region far outpaces any other region. Elvis Velea of V4Escrow gave a talk last year at MENOG about the IPv4 transfer market in which he described to process and prices observed. Prices ranges from $9-$11/address. Microsoft paid $11.25/address in the 2011 Nortel bankruptcy.
Thanks to the data compiled by RIPE, we can analyze who is selling and who is buying and where these parties reside. For the 1,848 address ranges (blocks) transferred between 1 January 2014 and 30 March 2015, 1,069 (58%) came from Romanian organizations. In fact, 947 (51%) of all of the blocks transferred in the RIPE region were from a single organization, namely, Jump.ro. Jump is willing to sell large blocks of IPv4 address space (around $10/address) or lease smaller blocks for $0.50/address/year. We wonder what kind of repo men they use for nonpayment.
Kidding aside, Romanian address space is pretty popular. Of the 4,656 routed prefixes that currently make up the Saudi Arabian part of the Internet, 1,498 or almost a third of them were Romanian just a few months ago. The Syrian state telecom got 184.108.40.206/16 from Romania’s Nav Telecom last August and Iranian telecoms bought over 1 million unique IP addresses in 85 transfers over the past year (80% from Jump.ro). Saudi Telecom received 17 IPv4 transfers since September last year representing over 1.5 million IP address: 14 were from Romanian sources and the other 3 were from Ukraine. At $10/address, those addresses would have cost Saudi Telecom $15 million – a non-trivial amount of money.
In fact, Romania is bucking the trend of monotonically increasing routing footprints exhibited by nearly every other country on earth. When we look at the amount of Romanian address space routed over the past year (pictured below), the day-to-day count declines by over 3 million starting last summer as their IP sell-off begins. Perhaps they are just getting out ahead of the transition to IPv6 and selling off address space to the 97% of Internet users still using the old IPv4 Internet?
In January, I wrote a post about MITM BGP hijacks that turned out to be caused by a seller of address space accidentally re-announcing transferred addresses and thereby creating a MITM BGP hijack. While most IPv4 transfers appear to be free from routing incidents, the A2B Internet incident isn’t an isolated event.
One of the more interesting cases of ongoing contention of transferred IPv4 address space is between US telecom giant Level 3 and the Mobile Communication Company (MCI) of Iran. On 27 October 2014, MCI received 220.127.116.11/17 from Netserv in Romania and began routing it immediately. However, there was a problem. Level 3 already announced 8 more-specifics of this address space (18.104.22.168/21, 22.214.171.124/21, 126.96.36.199/21, 188.8.131.52/21, 184.108.40.206/21, 220.127.116.11/21, 18.104.22.168/21, 22.214.171.124/21). Lest anyone think there is any funny business going on here — Level 3 has been announcing those routes continuously since early 2012 – likely covering routes for their customer Romanian incumbent Romtelecom.
The Iranians evidently noticed they were having trouble receiving inbound traffic to those IP address ranges because in early December they started announcing more-specifics of each of the Level 3’s more-specifics. By doing so, MCI nullified Level 3’s routes and regained use of the address space. MCI also had to announce two more-specifics (126.96.36.199/23 and 188.8.131.52/23) to wrest control from AS51656 — a Romanian ISP still routing a range within the /17 the Iranians bought in October. For the /24’s, there is nothing the Iranians can do but announce equivalent /24’s and go head-to-head with the other origin. The graph below illustrates the recent origins of a /24 in the /17 purchased by MCI. Half the Internet believes that Romtelecom is the origin while other half chooses the Iranian origin.
|184.108.40.206/22||220.127.116.11/22||Azadnetrasaneh Private Joint Stock Company||essensys Ltd 02/09/2014|
So what are the implications of all this?
Now that the Romanians have demonstrated that there is lucrative business to be had in selling off IPv4 address space, will we see ISPs in developing countries rush to sell off their address space for some quick cash? If such sales result in the IPv4 space getting sliced more and more thinly, we can surely expect the global routing table to increase in size, perhaps dramatically, as a result. Will this cause more router meltdowns? Also, what does this phenomenon say about IPv6 adoption? IPv6 address space is effectively free and infinite, yet more and more organizations are apparently now paying large sums to continue to acquire IPv4 addresses. Are the impediments to IPv6 adoption simply too great? Or are these transfers merely a convenient expedient during a time of transition?
The analysis in this blog post formed the basis for today’s story in the Washington Post by Craig Timberg:
Iran positions itself to be a tech leader in turbulent Middle East http://t.co/W2yU1YosyP
— Post Business (@washpostbiz) April 6, 2015
Other press coverage of this story includes the following:
— Stephen Lawson (@sdlawsonmedia) April 9, 2015
— ZDNet (@ZDNet) April 7, 2015
— Dyn Research (@DynResearch) May 22, 2015
— Dyn Research (@DynResearch) June 15, 2015