Hi all, Here are some more detailed statistics for IRT queries made in January this year. (1) 204,318 total queries specifying irt flag (-c / --irt) These requests came from 497 distinct IP addresses. 13 IP addresses made >1,000 requests, which accounted for 185,910 total requests, or 91% of the total. Of these 13 IP addresses, 6 are in the same /24 network, which accounted for 88,493 total requests, or 43% The vast majority of the requests were for a single IPv4 address, which wasn't repeated (i.e. no polling). (2) 546 total queries specifying an IRT- primary key. These requests came from 139 distinct IP addresses. A single IP address made 135 requests, or 25% of the total. There were 63 distinct queries with an IRT- primary key (i.e. some queries were repeated a few times). Regards Ed

On 2 Mar 2020, at 10:25, Edward Shryane <eshryane@ripe.net> wrote:

Hi all,

Here are some statistics on IRT queries for January. How much usage do these IRT objects get?

Some background reading on IRT objects: https://www.ripe.net/manage-ips-and-asns/db/irt https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-datab...

The IRT object is meant to be used by Incident Response Teams directly, and "abuse-c:" is meant for general abuse complaints.

IRT objects are *not* returned by default in Whois queries. Users must either specify the -c / --irt flag on an IP lookup, or specify the IRT-* primary key.

There are about 400 IRT objects in the Whois database. To reference an IRT object from an IP range, you must add an "mnt-irt" attribute (and authenticate with the IRT object). I found 12,694 references to IRT objects from inetnums, and 901 references from inet6nums. A total of 174 distinct IRT objects are referenced (leaving 226 unreferenced).

Out of 2 billion Whois queries in January, I found 204,318 queries with the irt flag (or ~7k/day), and 546 queries (or about 18/day) for an IRT object using the primary key.

Let me know if you have any questions or would like more details.

Regards Ed Shryane RIPE NCC