Summary

  • APNIC says a mntner object authorises updates to its Whois database and uses mnt-lower alongside mnt-by when maintainers form a hierarchy.
  • That hierarchy governs registry changes. It does not establish a BGP customer cone, a transit relationship, a live origin, reachability, legal ownership, or present control of routers and credentials.

Lower in a database, not lower in the network

APNIC’s inetnum object guide describes a maintainer object as a database object used to authorise updates to the APNIC database. An address record normally has mnt-by, identifying the maintainer that protects it. When there is a hierarchy of maintainers, APNIC says mnt-lower is used as well.

The operational meaning follows from those definitions. A record protected at one level may nominate another maintainer for lower-level objects or delegations. The field answers a registry question: which authenticated maintainer is authorised in the update chain below this object? It does not answer which autonomous system carries traffic, which operator supplies transit, or which routers can reach the prefix.

The distinction is easy to lose because the same address record may sit near routing-related information and because “lower” sounds like a topology term. But a database hierarchy and a routing hierarchy observe different systems. The former governs who may change registered objects. The latter would need evidence about actual announcements, adjacencies, policy and packet paths at a stated time.

Three maintainer fields, three careful readings

APNIC documents mnt-by, mnt-lower and mnt-routes separately. mnt-by protects the object itself. mnt-lower participates in the hierarchy for lower-level registry objects. mnt-routes identifies the maintainer used to control creation of route objects associated with the address range. These fields may name the same maintainer, or different ones, without turning them into measurements of a live network.

APNIC’s advanced query guide reinforces the separation. It assigns distinct inverse lookups to mnt-lower, mnt-routes and origin. An analyst can search for objects that reference a maintainer in one role without claiming that the result proves another role. An origin attribute belongs to a registered route object; it is still a registry statement, not a direct observation of an announcement.

A live APNIC Whois example shows mnt-by, mnt-lower and mnt-routes together. The useful evidence is precisely what the response says, captured with query and time. It shows how the registry object was protected and what maintainer references were present. It does not show whether a route was visible, whether packets reached a service, or whether a commercial agreement remained in force.

Preserve the registry observation

A defensible capture records the queried resource, response text, retrieval timestamp, object type, range, status, maintainer handles and change dates. It also preserves which attribute carried each handle. Flattening all maintainer references into a single “operator” field destroys the distinction that the registry itself maintains.

The next test depends on the claim. For observed origination, consult time-aligned BGP collectors and record vantage points. For routing authorisation, inspect the relevant RPKI state separately. For declared policy, examine the appropriate IRR objects while remembering that declarations are not observations. For present control, seek current operator confirmation and credential or change-control evidence. For a commercial relationship, use direct contractual or public evidence rather than a maintainer name.

This layered method does not diminish Whois. It makes it more useful. mnt-lower can reveal a delegation of registry-update authority, help trace responsibility for object maintenance, and suggest whom to contact when data needs correction. Those are meaningful findings. They become unreliable only when promoted into claims the field was never designed to support.

The disciplined conclusion

Read mnt-lower as a typed, time-bounded registry fact: a maintainer-hierarchy reference observed on a particular object. Do not silently upgrade it into routing hierarchy, transit, reachability, ownership or present operational control. If the investigation needs one of those conclusions, move to the evidence system that observes it and preserve the boundary between the two.

Sources