On Mon, Jun 29, 2020 at 10:31 AM Peter Müller via db-wg <[email protected]> wrote: > > Dear RIPE DB mailing list people, > > we, the IPFire development team, just bumped across an IP address somewhere > in the 51.15.0.0/17 network (no abuse, we were just curious :-) ). > > While the RIPE Whois server returned "NL" as the country of that subnet [1], > the "delegated-ripencc-extended-latest" file available at ftp.ripe.net [2] > only > contains 51.15.0.0/16, which points to "FR". > > Since the first one result contains the correct country code of that IP > network, > I would like to ask why "delegated-ripencc-extended-latest" does not include > subnets like this, and where the Whois server fetches his answer from.
If you run a query for an individual address you will be given a response for the most specific network containing that address. In contrast, the stats file will give you the aggregate, along with things like original registration date and a country code for the organization that controls the whole block. It is possible for a controlling entity in country A to have a branch office or customer in country B. That's why more specific registrations sometimes have a different country code from the parent. The RIPE Database, queried by Whois or RDAP, serves a different purpose from the stats file. The former enables communication between operators and supports the routing registry. The latter is to provide high level statistical data to researchers. Kind regards, Leo Vegoda
