Hi Randy & Nick,
Maybe use indicators like different ASN paths, different source asns, changes to registered object, etc? All very subjective though.
yep.
I've had several people ask me questions in regards to changes for PI space. Some even think that changing the Supporting LIR (PI) is sufficient to make the required changes at RIPE to transfer resources ... Others thought that an IP is an IP and that one was also allowed to sell PI space (under the current policy) ... None of the people that came to me were correctly upfront and shocked that what they were doing is not according to the policy or even not a transfer in the actual change of legal entity ... However the look on somebody their face is priceless if you tell them that the 'seller' can just resell the space to someone else as they still hold the ownership according to the registry. Using BGP data to tell if some got his space from the market might give a lot of false positives. Not all IP space that changes from AS, is also a permanent change ... (think about leased IP's, which doesn't require the registry to be updated on the ownership.) Personally I think it might be very hard to identify black market transfers ... especially since pimping ones prefixes to another AS for $$$ is common practice these days. Erik Bais