Trading IPv4 Addresses Starts Making Internet Elders Nervous

by on August 15, 2011 · 11 comments

Paul Vixie, a renowned Internet pioneer who runs the Internet Systems Consortium, has written an article in ACM Queue attacking “those who would unilaterally supplant or redraw the existing Internet resource governance or allocation systems.” The publication of this article is a sign of a growing, important debate around the reform of IP address registries in the age of IPv4 exhaustion.

Vixie defends the Regional Internet Registries monopoly on IP address registration services and its current, needs-based policies toward address transfers. I am sure that Paul sincerely believes in the arguments he makes, but it’s also true that Vixie is the chairman of the Board of The American Registry for Internet Numbers (ARIN), the regional address registry for North America. When Vixie argues that ARIN’s exclusive control over Whois and address transfer services is beneficial and “in the physics” he is also defending the authority and revenue model of his own organization against a perceived threat.

And that takes us to another relevant fact. The argument Vixie makes is cast in generalities, but he is really attacking a specific firm, a holding company known as Denuo. Denuo has formed both a secondary marketplace called Addrex for the legitimate trading of IPv4 number blocks, and an IP Address Registrar company known as Depository. Let’s set aside Depository for the moment (I will come back to it) and concentrate on Addrex, which has become the first end-to-end platform for legacy address holders to sell their IPv4 number blocks. Famously, Addrex scored a major success as the intermediary for the Nortel-Microsoft trade. But Nortel-Microsoft was unusually visible because it had to go through bankruptcy court. Is anything else happening? I spoke to Addrex’s President Charles Lee since then to find out. “We are very busy signing up a growing number of global corporate and governmental customers to sell their unused assets,” he said. I asked him what the buyer side of the marketplace was beginning to look like and he said “Our value proposition to large Asian network operators has resonated quite effectively and we expect to enter into many agreements with them over the coming months.” Surely Vixie and the ARIN Board have gotten wind of this. So when Vixie begins a public attack on this company and its business model, he is signaling to the rest of us that ARIN is worried.

It should be. Vixie’s article is premised on a stretched, invalid comparison of Denuo to the proponents of competing DNS roots. But alt.root proponents were almost always lightweight rebel-operators who could never, as Vixie correctly points out, make a stable, serious value proposition to end users. Even New.net, the alt.root blessed with millions in venture capital, never came close to success, because there was just not much value in offering someone registration under a top level domain that only one tenth or less of the Internet could see. (To salvage its unviable business model Net.net was pushed into a number of questionable tactics.)

Denuo/Addrex is most emphatically not like that. They have a simple, valuable business proposition to make to buyers and sellers of legacy address blocks: entities with surplus addresses can profit from them, entities who need more can get them. Businesses who use their services do not cut themselves off from part of the Internet – on the contrary, they help to maintain and secure their connectivity. And they do it without subjecting themselves to the uncertainty and bureaucracy of an ARIN “needs assessment.” Moreover, although Denuo will no doubt benefit handsomely by being the first mover in this market, its success in no way depends on being the only person who ever pursues this business model. There is no reason why there could not be as many address brokers as there are real estate brokers.

But Vixie says this will all end in tears. Shorn of hype and rhetoric, Vixie’s argument amounts to this: if people are allowed to trade addresses outside of ARIN’s control, then we cannot have an accurate registration database that tells us who holds which address block.

That argument is obviously wrong. It would be a simple matter for ARIN (and other RIRs) to set up procedures to recognize and record transactions conducted by external parties – if they were willing to surrender pointless “needs assessments.” We have thousands of stock brokers and dozens of exchanges independently trading shares, but somehow the world manages to keep track of who does and does not own a specific quantity of critically important stock certificates. So ARIN does not need to control, mediate and set policy for all IP address transfers in order to maintain an accurate database of who holds which address block. It simply needs to serve as a title agency where people come to record their transactions. It is in the self-interest of both sides of an IP address transaction to ensure that their transfer of rights was recorded and is published in a common, authoritative global Whois database. Think of your local county or village property recorder. They do not insist on being a real estate brokerage in their territory – much less the only brokerage. There are many parties who can independently engage in property transactions and then bring them to the property registry for verification and recording.

Vixie is not appealing to the “physics” of registration and database economics – indeed, Vixie’s belief that industrial organization is explained by “physics” rather than economics is a bit odd. What’s really happening here is that Vixie and others at ARIN realize that the only way to shield themselves against losing control over and revenue from the IPv4 address market is to leverage their monopoly over the IP address registration database. What they would like to do is discourage competing and independent address trading and registration firms by refusing to make changes in their Whois database to reflect independent transactions. In antitrust/economics terms, they are tying registration records, which do need to be integrated and uniform, to another potentially competitive service, address brokerage and post-allocation registration services, so that it can continue to enjoy a monopoly in both. The penalty for trading addresses outside of its transfer regime is to be banished from or ignored by ARIN’s Whois database.

This is a risky strategy, and the community that ARIN claims to represent should question it. There are powerful economic incentives for legacy holders and companies that need more addresses to trade. Those trades are going to happen. There are also strong economic incentives for those holding legacy resources to avoid contracting with ARIN and other RIRs. Those companies could choose to sign up with Depository and other companies like it. If ARIN refuses to record them because it doesn’t approve of the company or is not in control of the transaction, ARIN will be the one responsible for fragmenting and corrupting the IP address registration database.

Vixie’s argument about Whois fragmentation is doubly wrong when one realizes that the Whois database ARIN runs is actually a mess when it comes to pre-1997 address blocks (slightly over 40% of the available space). There are hundreds of firms that no longer exist listed there, and thousands of registration records that have not changed in fifteen years. I reached out to Charles Lee of Addrex about Vixie’s article to get his comments on it. He first issued a disclaimer that “generally, we…do not engage in public debates about Internet governance. We prefer to focus on our clients and serving their needs.” But he felt that Vixie’s posting contained “misleading inaccuracies” that required some comment.

“The present Whois system which Mr. Vixie defends with such verve absolutely cannot be relied upon. That is not a personal position or opinion. It is a fact. As an illustrative example let’s use the now famous Nortel/Microsoft deal which was brokered by Addrex Inc. In that transaction not one of the 38 number blocks transferred from Nortel Networks Inc. to Microsoft Inc. were appropriately listed in any Whois database in the name of Nortel Networks Inc. It took hundreds of man-hours and over two thousand pages of documentation to reconcile the fiction of the Whois system entries to the reality of Nortel Networks. Unfortunately that now famous case is not the exception to the rule but rather the reality of the situation. For Mr. Vixie to even suggest that Network operators could, or should, rely on an identification system rife with such gross errors is unconscionable.”

It’s likely that private, commercially motivated firms will do a far better job of cleaning up the Whois records than ARIN will on its own. Denuo’s Depository, for example, is already advertising its ability to research and verify “chain of custody” of address holdings. Depository has advocated a “registry-registrar split,” analogous to the one in Domain Name Service, to allow competing firms to provide post-allocation registry services while maintaining the RIRs as a single, accurate registration database. Vixie’s argument that competition from Denuo assumes that no “copycat” competition will ever emerge is 100% wrong. The structural reforms Denuo has advocated are actually designed to pave the way for more competition in that field hence their filing with ICANN to create an accreditation policy for all IP address registrars.

To conclude, Internet elders such as Vixie have done a wonderful job writing software and defending the Internet’s standards and architecture against various threats. For this, we can be respectful and grateful. But expertise in technology does not necessarily translate into expertise in economics and public policy. Vixie’s polemic in ACM queue shows us that expertise in one domain often becomes blind arrogance in another. Only someone determined to preserve ARIN’s monopoly would ever make the claims he makes.

  • Inettek_2000

    Vixie is not the chairman of ARIN. 

    https://www.arin.net/about_us/bot.html

    Fact checking its the latest trend in journalism. Try it some time.

  • Taylor Hackmann

    Mr. Vixie provided as part of his published thoughts in the ACM Queue article the following:

    PAUL VIXIE is president of ISC (Internet Systems Consortium), a nonprofit company that operates the DNS F root name server and publishes the BIND software used by 80 percent of the Internet for DNS publication. He is also chairman of ARIN (American Registry for Internet Numbers), a nonprofit company that allocates Internet number resources in the North America and Caribbean region. Previously, Vixie was a founder and president of PAIX, the first neutral commercial Internet exchange; senior vice president/CTO of AboveNet; and founder of the first anti-spam company (MAPS LLC) in 1996.

    He was elected Chairman of the Board of ARIN and now serves as Secretary. Maybe he should also update his information which he lists about himself then. 

    What appears to be more ironic is that Mr. Vixie was part of the cabal that split the root on January 28th, 1998. 

  • Jason Nash

    Hello,

    I am Jason and I represent the most trusted low-cost web hosting reviews in the market.
    I am really amused with the way you present your ideas/concepts on your site.

    Would you be open in discussing a sensible business proposal or sponsorships?

    Thanks,

    Jason

  • Milton Mueller

    Vixie identified himself as the Chair of ARIN in his own article. Maybe you should lecture him about that “fact checking”

  • Info

    Vixie is the Chief Scientist at ISC, no longer the President.  It’s not his job to update his bio AFTER he writes something so that lazy authors don’t need to fact check!!

  • Max Van Norman

    Seems he wrote this just last week. His bio is something which most people would manage on their own. “Lazy authors” … huh? how about addressing the various points raised? 

    I didn’t know that ARIN’s Whois is so inaccurate. We use it all the time. That is truly worrisome. Doesn’t that rate a mention?

    Who gives a damn about what position Vixie claims he has versus the author? Really? What is just remarkable is that no one from ARIN is refuting that the 30 something blocks were all wrong. I read someone on another board say it was the responsibility of Nortel to update them. But I’ve read that Nortel never entered into any agreement with ARIN. How is that possible? Doesn’t ARIN have a contract from ICANN/United States Government to be the authority in charge of these resources?

    We spend a lot of time worrying about ARIN and its changing policies. Maybe we don’t have to if they can’t do the job they are supposed to do. 

    Max

  • Jcurran

    Max – Any holder of address blocks in the ARIN region can update their contact information without contract with ARIN or charge, so there is no reason for information to be out of date unless the registrant doesn’t bother to update it.

  • Jcurran

    Max – Any holder of address blocks in the ARIN region can update their contact information without contract with ARIN or charge, so there is no reason for information to be out of date unless the registrant doesn’t bother to update it.

  • Jcurran

    Max – Any holder of address blocks in the ARIN region can update their contact information without contract with ARIN or charge, so there is no reason for information to be out of date unless the registrant doesn’t bother to update it.

  • Max Van Norman

    Is this John Curran? Wow … 

    Okay, here goes … doesn’t every service customer belong to ARIN? Can’t you force them to update, if they don’t then just take back the addresses? You are under contract to Icann to do that, right? Or is it the US Gov? 

    Simply put, I have read that Nortel said they did not ever sign any thing with ARIN, but how can that be? Two of my customers are thinking of signing up with ARIN for their old addresses but stopped when the legal team said wait. Can’t you just call them up and say, “hey, sign and pay like the rest of us or we take them back.”

    Lastly, I have read a bunch of these guys going back and forth about the Whois database. How many records haven’t been updated in, say the last ten years? If what the guy said in the article is true, then WHY SHOULD WE TRUST YOU? My entire business is building trust with my customers and whoa and behold, you don’t have any reliable data? I have never questioned you guys before, but if this is true, that you really do not have accurate records, then I will tell my customers never to believe your data again. 

    Please tell us, how bad is it? How many records have not been updated in the last ten years. That should be easy to tell all of us. 

    Max

  • Jcurran

    Max - 
     
       This is John Curran.   I’ll try and answer your question as best I can, although you may not like the answers.

    “Can’t we just force them to update their records?”

         First, we often don’t get told (and hence don’t know) when someone doesn’t update their records.  This happens with DNS as well; many records for domains may reflect organizations that have moved, changed names, or merged.

        Second, as for “forcing”, we could theoretically revoke the numbers if the community passed a policy which directed us to do so for out of date entries.  The operational impact of that could be severe, however, and such a policy is unlikely.

    “How many records haven’t been updated?”

        Again, difficult to know.  We don’t know if someone has moved or changed their administrative contact.   We are now sending reminders to people (just as you receive for a DNS name) to have people update their contact info, and have more updating their records (more than 30% of reminders are resulting in updates in some cases)

       If you want us to revoke address blocks that haven’t been updated in a certain period, please suggest that as a policy proposal and discuss it.   We follow community-develoed policies, and your needs may match others and achieve consensus.  https://www.arin.net/participate/how_to_participate.html

    /John

    John Curran
    President and CEO
    ARIN
       

Previous post:

Next post: