1
APNIC Update
Sunny Chendi
NPIX AGM 2016 – NPNOG v0.5
06 August 2016
APNIC’s Vision
A global, open, stable and secure
Internet that serves the entire Asia
Pacific community
2
APNIC Activities
3
Serving
Cooperating
Supporting
Annual IPv6 Delegations
4
By delegation type
>=/31
/32
/43-/47
/48
By size By request type
As at 30 June
Allocation
Assignment
One-click
Normal
0
200
400
600
800
1000
2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
Annual IPv4 Delegations
0
1000
2000
3000
4000
5000
2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
5
From 103
pool
From
recovered
pool
/24
/23
/22
NIR
New
Existing
By pool By size By Member
As at 30 June
Annual ASN Assignments
6
2-byte
4-byte
By type
Rejected
Accepted
4-byte return rate
As at 30 June
0
200
400
600
800
1000
2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
4-byte
2-byte
Annual IPv4 Transfers
7
Used
Did not use
Using listing service
Used
Remaining
Pre-approval usage
As at 30 June
0
50
100
150
200
2010 2011 2012 2013 2014 2015 2016
Intra-RIR
Inter-RIR
APNIC Membership
0
1000
2000
3000
4000
5000
6000
1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
XL
VL
L
M
S
VS
AS
As at 30 June
8
Registration Data Access Protocol
9
Standardized JSON query/response
RESTful web services over HTTP
Automatic inter-registry redirection
Authorization at attribute level
Internationalization using UTF-8
RDAP Deployed in
production 2015
Solves a number of
limitations to WHOIS
protocol
www.apnic.net/rdap
RPKI
“Ready to ROA” campaign – hands-on sessions to
help Members create ROAs
Regional RPKI adoption growing: from 0.8% to
3.44% and rising over last 17 months
www.apnic.net/roa
ROA stats (to date)
Enabled ROA engine count 609
Numbers of ROAs created 409
Number of IPv4 addresses
under ROAs (/32s)
7,508,736
Number of IPv6 addresses
under ROAs (/56s)
1,998,555,200
% allocated space under ROAs
(IPv4)
0.87
% allocated space under ROAs
(IPv6)
0.24
10
Motivation behind RPKI (ROAs)
11
• Prevent route hijacking
– Only the rightful custodian can originate the prefix announcement
• Minimize common routing errors
– Human errors
Member RPKI query
12
“Hi,
This is w.r.t my registration on BGPMon for RPKI-ROA status for securing BGP
&
to avoid BGP Hijack. Based on the registration. I received the below alerts.
Please guide for the same since I want to secure my ASN & prefixes. “
====================================================================
RPKI Validation Failed (Code: 9)
====================================================================
Your prefix: xxxxxxxxxxxxxxxxx:
Prefix Description: xxxxxxxxxxxxxxxxx
Update time: 2014-10-15 09:41 (UTC)
Detected by #peers: 4
Detected prefix: xxxxxxxxxxxxxxxxx
Announced by: xxxxxxxxxxxxxxxxx
Upstream AS: xxxxxxxxxxxxxxxxx
ASpath: xxxxxxxxxxxxxxxxx
Alert details:
https://portal.bgpmon.net/alerts.php?details&alert_id=47198623
Mark as false alert: https://portal.bgpmon.net/fp.php?aid=47198623
RPKI Status: No ROA found
RPKI ready?
13
Route and ROA management
Members can create ROAs while creating
route objects
14
Route and ROA management
15
ROAs in South Asia
Country IPv4 prefixes covered IPv4 prefixes valid
Afghanistan 0% 0%
Bangladesh 25.11% 24.05%
Bhutan 86.67% 86.67%
India 0.04% 0.03%
Maldives 0% 0%
Nepal 55.3% 18.28%
Pakistan 12.17% 12.14%
Sri Lanka 50.18% 40.57%
16
source : https://lirportal.ripe.net/certification/content/static/statistics/world-roas.html
date : 18 July 2016
Nepal
17
http://rpki.apnictraining.net/output/np.html
Total ASNs delegated by RIR: 57
Visible IPv4 routes: 443
Visible IPv6 routes: 12
Nepal
• Most Invalid ROA are for:
– Route Prefix length is greater than the maximum length allowed by
VRP(s) matching this route origin ASN
• Invalid ROA originating ASN are
– AS23752
18
RPKI data violation example
19
MyAPNIC Improvements
20
Improving major
features of
MyAPNIC
Authorized contact
management
Whois records
management
Reverse DNS
management
Route and ROA
management
MyAPNIC speed
improvement – 24%
faster response time
Simplified whois
updates
Whois Accuracy Project
21
Simplifying contact
update process
Assisting with IRT
registration process
Clearer information
about PoC in IP
address object
Guidelines on using
and updating
information in whois
Monthly cleanup
program on
referenced objects
(12 months+)
Easily report invalid
contacts
Improving
database and
information
accuracy to
provide better
user experience
Website Improvements
22
Navigation and usability improvements to home
page and services pages
2015 Policy Implementations
23
Proposals approved at
APNIC 40 Policy SIG
prop-113: Modification in
the IPv4 eligibility criteria
prop-114: Modification in
the ASN eligibility criteria
www.apnic.net/policy
The APNIC Development Program
24
Supports the growth of
the Asia Pacific
community by
providing:
• Training and
technical assistance
• Infrastructure
support
• Grants and awards
• Research
APNIC Training
25
2016
(to date)
• 30 F2F courses
held in 15
locations
• 915 F2F trainees
• 529 trainees in
69 eLearning
sessions
• Video archives:
101 videos;
389,060 views
NOG Outreach
BTNOG 1 SANOG 24
MMNOG
SGNOG 2015
26
MMNOG 2015
www.apnic.net/nog
2016: JANOG
(Jan), PHNOG
(Jan), SANOG
(Jan), bdNOG
(Apr), TWNOG
(Jun)
… and many more
to come!
• Technical and
APNIC updates
• Hostmaster
consultations
• Training
sessions
• Sponsorship and
logistical support
bdNOG 5
Security Outreach
Craig Ng
NOGs, CSIRTS and LEA
events
PK, CN, HK, KR, JP, PH, SG,
MY, ID, AU, LK, MV, TW
Collaboration with JICA and
KISA to deliver regional
CERT training
Geoff Huston member of
ICANN SSAC
Adli Wahid member of FIRST
Board; invited to join
INTERPOL Global
Cybercrime Expert Group
27
www.apnic.net/security
Adli Wahid
ITU/APNIC IPv6
workshop
ITU/APNIC IPv6
workshop
IPv6 Outreach
APNIC/ITU IPv6
Workshop, Bangkok
28
2016 (to date)
• 232 trainees in 6
economies
• IPv6 presentations
at 7 events
• IPv6 workshop
with ITU in TH &
KH
• Supporting
APIPv6TF
Secretariat
www.apnic.net/ipv6
The APNIC Foundation
29
Established in Hong
Kong to support and
expand the APNIC
Development Program
Next APNIC Conference
30
conference.apnic.net/42
Colombo, Sri Lanka
Workshop: 28 Sep to 2 Oct
Conference: 3 to 5 Oct
Later Conferences
• APRICOT 2017, Ho Chi Minh City, Vietnam
– 20 February to 2 March 2017
• APNIC 44, Taichung, Taiwan
– 7 to 14 September 2017
31
Stay in Touch!
blog.apnic.net
apnic.net/social
32
33
THANK YOU

APNIC Update, NPNOG 0.5

  • 1.
    1 APNIC Update Sunny Chendi NPIXAGM 2016 – NPNOG v0.5 06 August 2016
  • 2.
    APNIC’s Vision A global,open, stable and secure Internet that serves the entire Asia Pacific community 2
  • 3.
  • 4.
    Annual IPv6 Delegations 4 Bydelegation type >=/31 /32 /43-/47 /48 By size By request type As at 30 June Allocation Assignment One-click Normal 0 200 400 600 800 1000 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
  • 5.
    Annual IPv4 Delegations 0 1000 2000 3000 4000 5000 20062007 2008 2009 2010 2011 2012 2013 2014 2015 2016 5 From 103 pool From recovered pool /24 /23 /22 NIR New Existing By pool By size By Member As at 30 June
  • 6.
    Annual ASN Assignments 6 2-byte 4-byte Bytype Rejected Accepted 4-byte return rate As at 30 June 0 200 400 600 800 1000 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 4-byte 2-byte
  • 7.
    Annual IPv4 Transfers 7 Used Didnot use Using listing service Used Remaining Pre-approval usage As at 30 June 0 50 100 150 200 2010 2011 2012 2013 2014 2015 2016 Intra-RIR Inter-RIR
  • 8.
    APNIC Membership 0 1000 2000 3000 4000 5000 6000 1998 19992000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 XL VL L M S VS AS As at 30 June 8
  • 9.
    Registration Data AccessProtocol 9 Standardized JSON query/response RESTful web services over HTTP Automatic inter-registry redirection Authorization at attribute level Internationalization using UTF-8 RDAP Deployed in production 2015 Solves a number of limitations to WHOIS protocol www.apnic.net/rdap
  • 10.
    RPKI “Ready to ROA”campaign – hands-on sessions to help Members create ROAs Regional RPKI adoption growing: from 0.8% to 3.44% and rising over last 17 months www.apnic.net/roa ROA stats (to date) Enabled ROA engine count 609 Numbers of ROAs created 409 Number of IPv4 addresses under ROAs (/32s) 7,508,736 Number of IPv6 addresses under ROAs (/56s) 1,998,555,200 % allocated space under ROAs (IPv4) 0.87 % allocated space under ROAs (IPv6) 0.24 10
  • 11.
    Motivation behind RPKI(ROAs) 11 • Prevent route hijacking – Only the rightful custodian can originate the prefix announcement • Minimize common routing errors – Human errors
  • 12.
    Member RPKI query 12 “Hi, Thisis w.r.t my registration on BGPMon for RPKI-ROA status for securing BGP & to avoid BGP Hijack. Based on the registration. I received the below alerts. Please guide for the same since I want to secure my ASN & prefixes. “ ==================================================================== RPKI Validation Failed (Code: 9) ==================================================================== Your prefix: xxxxxxxxxxxxxxxxx: Prefix Description: xxxxxxxxxxxxxxxxx Update time: 2014-10-15 09:41 (UTC) Detected by #peers: 4 Detected prefix: xxxxxxxxxxxxxxxxx Announced by: xxxxxxxxxxxxxxxxx Upstream AS: xxxxxxxxxxxxxxxxx ASpath: xxxxxxxxxxxxxxxxx Alert details: https://portal.bgpmon.net/alerts.php?details&alert_id=47198623 Mark as false alert: https://portal.bgpmon.net/fp.php?aid=47198623 RPKI Status: No ROA found
  • 13.
  • 14.
    Route and ROAmanagement Members can create ROAs while creating route objects 14
  • 15.
    Route and ROAmanagement 15
  • 16.
    ROAs in SouthAsia Country IPv4 prefixes covered IPv4 prefixes valid Afghanistan 0% 0% Bangladesh 25.11% 24.05% Bhutan 86.67% 86.67% India 0.04% 0.03% Maldives 0% 0% Nepal 55.3% 18.28% Pakistan 12.17% 12.14% Sri Lanka 50.18% 40.57% 16 source : https://lirportal.ripe.net/certification/content/static/statistics/world-roas.html date : 18 July 2016
  • 17.
    Nepal 17 http://rpki.apnictraining.net/output/np.html Total ASNs delegatedby RIR: 57 Visible IPv4 routes: 443 Visible IPv6 routes: 12
  • 18.
    Nepal • Most InvalidROA are for: – Route Prefix length is greater than the maximum length allowed by VRP(s) matching this route origin ASN • Invalid ROA originating ASN are – AS23752 18
  • 19.
  • 20.
    MyAPNIC Improvements 20 Improving major featuresof MyAPNIC Authorized contact management Whois records management Reverse DNS management Route and ROA management MyAPNIC speed improvement – 24% faster response time Simplified whois updates
  • 21.
    Whois Accuracy Project 21 Simplifyingcontact update process Assisting with IRT registration process Clearer information about PoC in IP address object Guidelines on using and updating information in whois Monthly cleanup program on referenced objects (12 months+) Easily report invalid contacts Improving database and information accuracy to provide better user experience
  • 22.
    Website Improvements 22 Navigation andusability improvements to home page and services pages
  • 23.
    2015 Policy Implementations 23 Proposalsapproved at APNIC 40 Policy SIG prop-113: Modification in the IPv4 eligibility criteria prop-114: Modification in the ASN eligibility criteria www.apnic.net/policy
  • 24.
    The APNIC DevelopmentProgram 24 Supports the growth of the Asia Pacific community by providing: • Training and technical assistance • Infrastructure support • Grants and awards • Research
  • 25.
    APNIC Training 25 2016 (to date) •30 F2F courses held in 15 locations • 915 F2F trainees • 529 trainees in 69 eLearning sessions • Video archives: 101 videos; 389,060 views
  • 26.
    NOG Outreach BTNOG 1SANOG 24 MMNOG SGNOG 2015 26 MMNOG 2015 www.apnic.net/nog 2016: JANOG (Jan), PHNOG (Jan), SANOG (Jan), bdNOG (Apr), TWNOG (Jun) … and many more to come! • Technical and APNIC updates • Hostmaster consultations • Training sessions • Sponsorship and logistical support bdNOG 5
  • 27.
    Security Outreach Craig Ng NOGs,CSIRTS and LEA events PK, CN, HK, KR, JP, PH, SG, MY, ID, AU, LK, MV, TW Collaboration with JICA and KISA to deliver regional CERT training Geoff Huston member of ICANN SSAC Adli Wahid member of FIRST Board; invited to join INTERPOL Global Cybercrime Expert Group 27 www.apnic.net/security Adli Wahid
  • 28.
    ITU/APNIC IPv6 workshop ITU/APNIC IPv6 workshop IPv6Outreach APNIC/ITU IPv6 Workshop, Bangkok 28 2016 (to date) • 232 trainees in 6 economies • IPv6 presentations at 7 events • IPv6 workshop with ITU in TH & KH • Supporting APIPv6TF Secretariat www.apnic.net/ipv6
  • 29.
    The APNIC Foundation 29 Establishedin Hong Kong to support and expand the APNIC Development Program
  • 30.
    Next APNIC Conference 30 conference.apnic.net/42 Colombo,Sri Lanka Workshop: 28 Sep to 2 Oct Conference: 3 to 5 Oct
  • 31.
    Later Conferences • APRICOT2017, Ho Chi Minh City, Vietnam – 20 February to 2 March 2017 • APNIC 44, Taichung, Taiwan – 7 to 14 September 2017 31
  • 32.
  • 33.

Editor's Notes

  • #4  Reflects APNIC’s vision of a “global, open, stable and secure Internet that serves the entire Asia Pacific community: Serving APNIC Members Supporting Internet development in the AP region Cooperating with the Internet community
  • #5 The delegation rate for IPv6 increased in 2015 and continues to accelerate. So far in 2016, we have delegated 650 blocks of IPv6 which is a 151% increase on the same period last year (2015: 258 delegations up until end April). The majority of delegations have been a /32 (70%) which is the default allocation size for providers, followed by /48s which is the default assignment size for end-sites. Most came from normal allocations, instead of one-click.
  • #6 There was a marked increase in IPv4 requests from 2014 as a result of the availability of address space from the recovered pool. After four months of 2016, the level of delegations is at a similar rate to 2015. 43% of requests have come from the recovered pool and 57% from the last /8 pool. Unsurprisingly, the majority of the v4 delegations are /22s, which is the maximum allowed by the policy. In 2015, APNIC has made 1958 delegations from 103/8 and 2540 delegations from the recovered pool.
  • #7 From Jan 2010, APNIC ceased to make any distinction between two-byte and four-byte when assigning AS Numbers as a result of a policy change. It is good to note that the return rate for 4-byte is very low (2%), which illustrates acceptance of 4-byte ASN in the region.
  • #8 As of 1 October 2015 transfers are now available with the RIPE NCC region. 9 registered brokers listed on the APNIC website. Time required for transfers: minimum two days
  • #9  The total membership figure for 2015 was 5,268. So far in 2016, APNIC has 5,661 Members, and increase of 6.9% from the 2015 figure.
  • #10 Registration Data Access Protocol (RDAP) solves a number of limitation to the WHOIS protocol, for example: Standardizes the query format, so clients only need to learn one way to ask a registry about its data.  I Standardizes the response format, so clients only need to learn how to parse a response once.   It uses common technologies to deliver service, so tool developers can leverage existing libraries and frameworks.   It supports redirection, so querying APNIC for an ARIN address will redirect to ARIN’s service, and vice-versa.   And it supports internationalization, so data is no longer presented in a random character set, but instead always in UTF-8.
  • #11 Offline simulation of production system allows Members to create and revoke ROAs and observe changes to routing state
  • #21 MyAPNIC improvements planned for 2016. Simplified updates include: View and replace your whois contacts Bulk update your whois contacts View all objects associated in your account Reverse DNS management: Single page to manage your reverse DNS delegations Integrated reverser domain verification tool Route and ROA management Create your route and ROA objects in one go Automated notification to AS number custodians Manage conflicts between your route and ROA objects
  • #23 Expect more updates this year, including revamped IPv6 pages
  • #24 Changes to the request criteria for the delegation of IPv4 addresses and Autonomous System Numbers (ASNs) will make it easier for end-user organizations to prepare for multihoming without having to establish interconnect agreements before applying. There were no policy proposals discussed at the APNIC 41 Policy SIG, held with APRICOT 2016 in Auckland, New Zealand earlier this year.
  • #26 APNIC training aims to deliver vital skills to network operators across the entire region to help grow the Internet. Reviewing and updating existing materials. Introduced Juniper-based material and Juniper training lab. Recently introduced Huawei platform to training lab. On 14 April, held first training ever in Afghanistan (held remotely from Brisbane)
  • #27 We have provided sponsorship for 13 NOG events. In 2015, we have supported and participated at 17 Nog Events JANOG 35, Shizuoka, Japan 13-14 Jan SANOG 25, Kandy Sri Lanka 16-21 Jan NZNOG 2015, Rotorua New Zealand, 26-30 Jan THNOG, Bangkok, 9 March 2015 HKNOG 2015, Hong Kong, 17 April bdNOG 3, Dhaka, Bangladesh 18 May IDNOG 12 June PHNOG – 16 June PacNOG 17 – 13-17 July SANOG 26, 3-11 August MyNOG 5, 17-20 August SGNOG 4, 18-21 August AusNOG 2015, 27-28 August HKNOG 2, 14 September BdNOG 4, 10-15 November MMNOG, 21-22 November PacNOG 18, 30 November – 4 December
  • #28 Security specialist Adli Wahid, is working with different teams within APNIC as well as building relationship with potential and new partners that APNIC can leverage. Adli was recently elected as a board member of the Forum of Incident and Security Response Teams Build capability through training, providing content on security at APNIC and LEA training Participation in NOGs, inter-governmental forums, CERTS etc. We take that knowledge and share it with Members to raise awareness Collaboration with relevant organizations to increase activities in the region (APCERT, INTERPOL, FIRST) Highlighting relevant initiatives to Members to improve security such as IRT objects in whois, RPKI, and SAVE (BCP 38)
  • #29 We remain committed to promoting IPv6 and helping increase its adoption. As part of TAS outreach we collaborated with the ITU on a five-day IPv6 Infrastructure security workshop in Bangkok – 50 participants from 12 economies in the AP region. Also provided ITU Country Direct assistance on IPv6 in Ulaanbaatar, with a 3-day IPv6 infrastructure security workshop and ITU engineering assistance at 3 organizations – 50 participants from 22 organizations, with great encouragement from the Mongolian regulator. Plan to update IPv6 web pages on the APNIC website this year.