On Thu, 11 Jul 2024 at 10:15, Rubens Kuhl <rubensk@gmail.com> wrote:

If you look at TC, you will see that this object is part of ARIN-NONAUTH:

https://bgp.net.br/whois.html?q=199.52.73.0%2F24

route: 199.52.72.0/22
descr: Ernst & Young, Gurgaon Cyberpark, India
origin: AS132055
mnt-by: MNT-EYL
changed: zanub-h.kalathingal@sg.ey.com 20210614
source: ARIN-NONAUTH
remarks: ****************************
remarks: * THIS OBJECT CONTAINS PLACEHOLDER DATA
remarks: * Please note that all data that is generally regarded
as personal
remarks: * data has been removed from this object.
remarks: * To view the original object, please query the ARIN
Database at:
remarks: * http://www.arin.net/whois
remarks: ****************************
rpki-ov-state: not_found # No ROAs found, or RPKI validation not
enabled for source

It's also mapped to an existing RPKI entry:

route: 199.52.73.0/24
descr: RPKI ROA for 199.52.73.0/24 / AS132055
remarks: This AS132055 route object represents routing data retrieved
from the RPKI. This route object is the result of an automated
RPKI-to-IRR conversion process performed by IRRd.
max-length: 24
origin: AS132055
source: RPKI # Trust Anchor: arin

Perhaps RADB is preferring not to mirror non-authoritative databases ?

Rubens

On Wed, Jul 10, 2024 at 10:05 PM Aliaksei Sheshka <sheshkaoss@gmail.com> wrote:
>
> Hi folks!
>
> I noticed something unusual today, and perhaps some of you know the answer.
>
> Consider ARIN rr:
>
> $ whois -h rr.arin.net 199.52.73.0/24
> route: 199.52.73.0/24
> origin: AS132055
> descr: EY India
> admin-c: IAM12-ARIN
> tech-c: DNSAD85-ARIN
> tech-c: IAM12-ARIN
> mnt-by: MNT-EYL-Z
> created: 2022-10-19T08:37:50Z
> last-modified: 2023-11-27T15:10:44Z
> source: ARIN
>
> everything looks fine.
>
> Now RADB mirror:
>
> $ whois -h whois.radb.net 199.52.73.0/24
> % No entries found for the selected source(s).
>
> nothing! I suspect the mirror is out of sync.
>
> Now NTT mirror:
>
> $ whois -h rr1.ntt.net 199.52.73.0/24
> route: 199.52.73.0/24
> descr: RPKI ROA for 199.52.73.0/24 / AS132055
> remarks: This AS132055 route object represents routing data retrieved
> from the RPKI. This route object is the result of an automated
> RPKI-to-IRR conversion process performed by IRRd.
> max-length: 24
> origin: AS132055
> source: RPKI # Trust Anchor: arin
>
> As you can see it returns only RPKI data, and not ARIN. So ARIN data is not in sync there as well?
>
> However for 199.52.53.0/24 it returns both
>
> $ whois -h rr1.ntt.net 199.52.53.0/24
> route: 199.52.53.0/24
> origin: AS132055
> descr: EY India
> admin-c: IAM12-ARIN
> tech-c: DNSAD85-ARIN
> tech-c: IAM12-ARIN
> mnt-by: MNT-EYL-Z
> created: 2022-07-11T07:05:30Z
> last-modified: 2023-11-27T15:10:44Z
> source: ARIN
> rpki-ov-state: valid
>
> route: 199.52.53.0/24
> descr: RPKI ROA for 199.52.53.0/24 / AS132055
> remarks: This AS132055 route object represents routing data retrieved
> from the RPKI. This route object is the result of an automated
> RPKI-to-IRR conversion process performed by IRRd.
> max-length: 24
> origin: AS132055
> source: RPKI # Trust Anchor: arin
>
> My question is how and what happened? I suspect whois stream was incostent.
> Because if one check todays ARIN DB it surely has the data
>
> $ wget ftp://ftp.arin.net/pub/rr/arin.db.gz -O - 2>/dev/null | gzip -d | grep -A10 199.52.73.0/24
> route: 199.52.73.0/24
> origin: AS132055
> descr: EY India
> admin-c: IAM12-ARIN
> tech-c: DNSAD85-ARIN
> tech-c: IAM12-ARIN
> mnt-by: MNT-EYL-Z
> created: 2022-10-19T08:37:50Z
> last-modified: 2023-11-27T15:10:44Z
> source: ARIN
>
> Thanks!
>