RIPE NCC sweeps up the last IPv4 scraps

The final 1,024-address /22 blocks from the last normal 185.0.0.0/8 block were issued at the start of October. From now on, new RIPE NCC members (Local Internet Registries, LIRs) will only be able to get addresses from the Recovered Pool -- addresses that have previously been returned to the registry. However, such addresses won't necessarily consist of series of 1,024 contiguous addresses (a single /22 block). Instead, they may be multiple /23 blocks (512 addresses) and/or /24 blocks (256 addresses), which will require the use of extra routing capacity. Once those blocks have gone as well – probably this autumn – the only way of getting addresses will be to go on the waiting list to receive a returned allocation of 256 addresses after the mandatory six-month quarantine period.

IPv4 scraps

At the recent RIPE NCC Days, RIPE NCC's Internet Resource Analyst Anje Roosjen spoke about the consequences of IPv4 addresses running out. Although we take the view that the IPv4 address supply ran out long ago – with CGNAT and other makeshift solutions, end users don't get a full-featured internet connection – Roosjen suggested that the IPv4 addresses will never completely run out. The reason being that, as well as the address pool mentioned above, RIPE NCC also has a supply of reserved addresses, addresses that can be assigned temporarily for research and experimentation, addresses for internet exchanges (IXPs), and 'IPv4 scraps' (isolated address blocks smaller than /24). It seems that all those addresses will be made available to IXPs, enabling them to continue for maybe another ten years. For internet access providers, however, the chance to get a block of 1,024 addresses from RIPE NCC -- even one made up of fragmented /23 and /24 blocks -- has now gone.

LIR accounts

Over the last year, the number of LIR accounts has increased from 20,000 to 25,000 as people have scrambled to get a /22 block while they still could. According to researcher Rene Wilhelm, the surge in account creations began when RIPE NCC started on the last /12 block in September 2012. Assignment restrictions were already in effect at that stage.

In the years following that move, account closures (the red bars) also increased sharply. According to Wilhelm, that was mainly due to LIRs opening multiple accounts to get hold of /22 address blocks. After a holding period of two years, the blocks could be transferred to the organisation's primary LIR account or to another LIR. In an effort to stop that practice, the rules were changed in November 2015 to prevent LIRs opening subordinate accounts. However, that simply prompted the organisations in question to create new legal entities in order to qualify for IPv4 addresses. That in turn meant that RIPE NCC's customer base became opaque, leading to the ban on multiple accounts being dropped just six months later. Consequently, the 25,000 accounts now in existence actually belong to fewer than 20,000 customers. The biggest of those has seventy accounts.

Drop in LIR account numbers

Now that the scramble for the final /22 blocks is over, Wilhelm expects a sharp decline in the number of LIR accounts in the period ahead. In the last year, about 1,500 accounts have been closed -- most of them because the companies in question ceased trading or merged. However, a quarter of the closed accounts belonged to multiple-account holders who kept other accounts open. After the mandatory holding period had expired, they consolidated their address blocks in their primary accounts. Until 2019, membership of RIPE NCC cost an initial € 2,000 registration fee, followed by a subscription of €1,400 a year. RIPE NCC expects the 5,200 secondary LIR accounts to be closed at the earliest opportunity. The last multi-account holders waiting to consolidate their address blocks can do so at the end of 2021. Given that natural attrition leads to the closure of about a thousand accounts a year, it's likely that we'll see roughly 7,200 closures by that time. New accounts will of course also be created, but the net loss of RIPE NCC accounts over the coming two years is expected to be in the region of 4,500.

Growth of IPv4 transactions

As well as causing the surge and forecast drop in account numbers, the IPv4 rush has influenced the number and quality of transactions. Roosjen says that a commercial market in IPv4 address blocks has developed now that RIPE NCC is unable to provide them. Address block transfers between LIR accounts have been permitted since 2012, so that RIPE NCC doesn't lose sight of who actually controls which blocks. However, a holding period does apply to scarce assets: IPv4 addresses and 16-bit AS numbers. As the graph below shows, the number of IPv4 transactions has gone up considerably in recent years.

Suspicious and disputed transfers

At the same time, there's been a rise in the number of suspicious or disputed transfer investigations. The scarcity of addresses has led to some people trying to get hold of IPv4 blocks without following the proper procedures, and even by outright theft. There have been cases of documents being forged, for example, as well as blocks being snatched from owners with flawed security and long-disused blocks being spirited away. Such activities give rise to disputes about transfers made by unauthorised personnel and accusations of straightforward fraud. According to Roosjen, there are several hundred investigations a year, but fewer than 1 per cent of members are involved. An LIR that is found to have acted improperly is typically given an official or unofficial warning. Expulsions are rare: only a dozen or so this year. Like domain name registrants, LIRs need to keep their accounts and databases secure and take a cautious approach to sponsorships. Roosjen recommends following the Know Your Customer (KYC) principles used in the banking industry.

All gone!

Anyone thinking of opening a RIPE NCC account in the hope of getting hold of one last IPv4 address block is too late. By the time that an application has been processed, all the /22 blocks will be gone. At the start of October, about a million addresses in smaller blocks remained available. However, with 5,000 new accounts being opened every year, and every new account holder being entitled to 1,024 addresses, that million addresses won't last long. The very last (fragmented) address blocks are likely to be assigned late this year. Although it'll then be possible to go on a waiting list, that looks like a relatively slow and expensive route to take. It's expected that the equivalent of 2,000 or so /24 blocks will be returned to RIPE NCC this year. They will be quarantined for six months, and then assigned to new account holders in batches of 256 (which may be fragmented). You can monitor the depletion of RIPE NCC's pool of available IPv4 addresses here.

IPv4 market

With good reason, Roosjen suggests that internet access providers who need more IPv4 addresses should look to the market. The commercial going rate is currently about 25 dollars per address. However, even if they're willing to pay that much, new market entrants won't be able to offer large-scale IPv4-based services. And, as we've argued before, that's dampening market activity and impacting our innovation climate.

Roosjen was therefore at pains to emphasise that, although the last IPv4 crumbs remain to be swept up, it's vital to embrace IPv6. Worryingly, Wilhelm reports that, while most new LIRs receive IPv6 blocks as well, it's apparent from testing that most remain largely unused.