research: begin IP address ownership and routing map

2026-07-20 18:52:14 +00:00
parent 4752d490d4
commit ced31f7d8b
11 changed files with 215 additions and 5 deletions
@@ -8,6 +8,7 @@ This is the readable view of the canonical records in [`data/entities.csv`](../d
 | [Regional Internet Registries](regional-registries.md) | The five RIR service regions and public resource directories |
 | [Infrastructure and operations](infrastructure-and-operations.md) | DNS root, IXPs/peering, routing visibility, physical transport, operator communities |
 | [Security and resilience](security-and-resilience.md) | Incident-response directories and routing-security coordination |
+| [IP address map](ip-addresses.md) | Registration, route origin, operator, and service for individual addresses |

 ## How to use it

@@ -20,3 +21,4 @@ Start with the coordinating body or directory for the function you need. For exa
 - incident-response team discovery → FIRST or Trusted Introducer;
 - BGP visibility → Route Views or RIPE RIS;
 - submarine cable discovery → TeleGeography map, followed by operator/regulator verification.
+- exact IP investigation → special-purpose registry, RDAP, BGP origin, and operator evidence kept as separate claims.
@@ -0,0 +1,24 @@
+# IP address map
+
+The question “who owns this IP?” usually has several different answers. This directory separates registration, routing, operation, and service instead of forcing them into one unreliable `owner` field.
+
+## Initial records
+
+| Address | Registry classification | Registered resource holder | Current route origin | Operator/service | Globally routable |
+|---|---|---|---|---|---|
+| [`0.0.0.0`](ip/0.0.0.0.md) | IANA special-purpose | Not organizationally assigned | None | Unspecified address / “this host on this network” | No |
+| [`1.1.1.1`](ip/1.1.1.1.md) | APNIC public resource (`1.1.1.0/24`) | APNIC Research and Development | AS13335, Cloudflare | Cloudflare 1.1.1.1 recursive DNS service; APNIC–Cloudflare project | Yes |
+
+## Ownership model
+
+For every address, investigate these independently:
+
+1. **Classification** — public unicast, private, loopback, documentation, multicast, reserved, or another special purpose.
+2. **Registry chain** — IANA → RIR → allocated/assigned resource holder.
+3. **Route origin** — currently announced covering prefix and origin ASN.
+4. **Network operator** — entity operating the route or service.
+5. **Service** — what the exact address does, if publicly documented.
+6. **Infrastructure relationships** — IXPs, facilities, upstreams, cables, and geography where evidence permits.
+7. **Time and provenance** — registry and routing facts can change, so every claim needs a source and verification date.
+
+The canonical structured records are in [`data/ip-addresses.csv`](../data/ip-addresses.csv).
@@ -0,0 +1,26 @@
+# 0.0.0.0
+
+## Answer
+
+`0.0.0.0` is **not an ordinary public address owned by a company**. IANA records both the exact `0.0.0.0/32` address and its `0.0.0.0/8` parent as special-purpose protocol space.
+
+| Axis | Finding |
+|---|---|
+| Exact registry entry | `0.0.0.0/32` |
+| IANA name | “This host on this network” |
+| Parent block | `0.0.0.0/8` — “This network” |
+| Organizational holder | None; reserved by the IP protocol |
+| Destination allowed | No |
+| Forwardable | No |
+| Globally reachable | No |
+| Normal route origin | None expected |
+
+## Meaning
+
+The exact all-zero address is used as an unspecified source address in limited host-initialization contexts. It must not be treated as a normal globally reachable destination or as an address assigned to an ISP, cloud, or person.
+
+## Sources
+
+- [IANA IPv4 Special-Purpose Address Space](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml), checked 2026-07-20
+- [RFC 1122, section 3.2.1.3](https://www.rfc-editor.org/rfc/rfc1122.html#section-3.2.1.3)
+- [RFC 791](https://www.rfc-editor.org/rfc/rfc791.html)
@@ -0,0 +1,34 @@
+# 1.1.1.1
+
+## Answer
+
+`1.1.1.1` demonstrates why “owner” must be split into multiple relationships.
+
+| Axis | Finding |
+|---|---|
+| Exact address | `1.1.1.1` |
+| Registered covering prefix | `1.1.1.0/24` |
+| Registry | APNIC |
+| RDAP network name/type | `APNIC-LABS` / `ASSIGNED PORTABLE` |
+| RDAP registrant | APNIC Research and Development |
+| Current announced prefix | `1.1.1.0/24` |
+| Current route origin | `AS13335` |
+| Origin holder | Cloudflare, Inc. (`CLOUDFLARENET`) |
+| Operator/service | Cloudflare 1.1.1.1 public recursive DNS resolver |
+| Project relationship | APNIC–Cloudflare DNS Resolver project |
+| Globally routed | Yes |
+
+## Interpretation
+
+- **Registration:** APNIC RDAP identifies the resource as `APNIC-LABS` and the registrant as APNIC Research and Development.
+- **Routing:** RIPEstat reports `1.1.1.0/24` announced by `AS13335`, Cloudflare.
+- **Operation/service:** Cloudflare publicly documents `1.1.1.1` as its consumer recursive DNS service.
+- **Relationship:** APNIC RDAP explicitly describes an APNIC and Cloudflare DNS Resolver project and says the research prefix is routed globally by AS13335/Cloudflare.
+
+Therefore, saying only “Cloudflare owns 1.1.1.1” loses important registry context. A more accurate statement is: **the covering prefix is registered through APNIC to APNIC Research and Development, while Cloudflare originates the route and operates the public resolver service as part of the documented collaboration.**
+
+## Sources
+
+- [APNIC RDAP record](https://rdap.apnic.net/ip/1.1.1.1), checked 2026-07-20
+- [RIPEstat prefix overview](https://stat.ripe.net/data/prefix-overview/data.json?resource=1.1.1.1), checked 2026-07-20
+- [Cloudflare launch announcement](https://blog.cloudflare.com/announcing-1111/)