RIPE’s 88.1% Match Inside a Cross-Border Model

Summary

Emile Aben and James Cowie compared the country code in a prefix record with the country code of the AS observed originating it. The two matched in 88.1% of their analysis.
Their six-bucket graphic totals 99.57%, but its largest bucket is the 88.1% same-country match. The talk does not show the denominator behind its phrase “99.6% of cross-border origination.”

Analysis

France on the prefix, Spain on the route

Take 90.68.0.0/16. At RIPE RIS collector RRC21 in Paris, the observed AS path ended at AS12479. The slide deck pairs that route with two country codes: France for the prefix in the NRO Delegated Statistics and Spain for the originating ASN.

The two records answer different questions. The prefix’s allocation country comes from a resource record. The origination country comes from the country code attached to the AS seen at the right end of the observed path. One speaks to the resource holder’s registered base; the other follows a routing origin.

RIPE NCC made that distinction explicit when it implemented the first phase of NWI-10 in December 2020. Its notice says the country code for an LIR organisation is the country where the resource holder is legally based. The Extended Delegated Statistics file was updated to use the same code. A legal address and an operating network can sit in different countries.

At RIPE 93 on 30 October, Emile Aben of RIPE NCC and James Cowie presented a way to sort those differences. Their slides say the two codes match 88.1% of the time; they call the remaining 11.9% the residual. The authors say there is no reason to expect legal home and operational home to coincide on the Internet. They also say these country codes are a poor starting point for geolocation.

Distance explains only a slice

The first model borrows from trade economics. It treats country pairs like a gravity problem: distance, shared borders, language, former-colony ties, sibling territories and membership of the same RIR all enter a Poisson regression. The slides list 188 countries and 35,156 directed pairs.

Neighbour relations matter, the speakers say, but explain only about 18% of the residual. Distance has an inverse effect; nearby countries are more likely to share a legal registration and operating location. Shared borders, former-colony links and sibling territories also matter. Yet the model leaves many flows too large to explain by proximity alone.

The next pass adds country-level variables: GDP and population, national Internet registries, financial-secrecy scores, special administrative regions, government classifications, sanctions exposure, RIPE LIR counts, legacy IPv4 shares, inbound transfers, facility counts, RIR region and registered footprint. These variables help sort the remaining patterns. The talk does not publish coefficients or a variable-by-variable account of the fit.

Six buckets, one awkward denominator

The final graphic groups the observations into six intuitive cases. Address markets, cloud and hosting structures, plus IPv4 leasing account for 7.13%. Registration-seat countries account for 1.95%; regional operator groups for 1.61%; intermediary registration for 0.63%; and a metropole-and-territory model for 0.15%. The largest share, 88.1%, is “self-contained”: 97 countries announce at least 95% of their own space.

The five smaller shares add to 11.47%, close to the 11.9% residual. Add the self-contained 88.1% bucket and the graphic totals 99.57%, which rounds to 99.6%. That arithmetic is visible. The denominator is not. Slide 10 describes the six mechanisms as explaining “99.6% of cross-border origination”; slide 11 includes a country-match category that is not part of the cross-border residual as the deck defined it.

The talk supplies a useful map of patterns: hosting hubs draw resources from elsewhere; companies may register where incorporation is easy; one operator may serve several nearby markets; a third-country LIR can hold resources where direct membership or invoicing is impractical; and a network may sit inside a territory linked to a larger state. Those are explanations of record patterns, not pins marking where users, cables or packets physically sit.

A dated source extract, raw counts for each bucket and a denominator definition would show whether “99.6%” describes all observations or only the country mismatches. Until then, the 88.1% match and the five residual shares are firmer claims than the headline’s cross-border wording.