What triggers an RIR audit?

Most often a request for additional address space or a transfer, when the registry checks that existing resources are documented and used. RIPE NCC also runs periodic Assisted Registry Checks, and ARIN reviews organisation records on its own schedule.

Does ARIN require SWIP for all reassignments?

ARIN policy requires registration in WHOIS, via SWIP or a compliant distributed service, for each IPv4 reassignment of a /29 or more addresses. Confirm the current wording in the NRPM, as policy text changes.

How is IPv4 utilization measured by a registry?

By the address space you have documented as assigned or in use, relative to what you hold. Space that is deployed but not registered does not count towards it, which is why undocumented assignments cause requests to be refused.

What happens if registry records are inaccurate?

In the short term, requests for additional space or transfers are delayed until it is corrected. Persistently inaccurate records can escalate to a formal review of the resources held.

Can IPAM publish registry objects automatically?

Not out of the box. RIPE and APNIC offer APIs against their databases and ARIN has Reg-RWS, so the integration is buildable, but no IPAM tool ships it. Most operators run a scheduled comparison and update by hand.

Utilization Reporting and RIR Audits

Reviewed by Philippe Girard, RIR policy & compliance lead

Registry records and internal records drift apart quietly, and the discrepancy surfaces at the worst moment — when you are requesting more space or completing a transfer. This is the workflow that keeps them together.

Assumed: you hold address space directly from a registry or through a sponsoring LIR, and you have an internal record of assignments. For the internal side, see IPAM best practices.

What each registry expects published

The obligations differ, and the differences matter.

Registry	Assignment registration	Mechanism	Periodic check
RIPE NCC	Assignments must be registered in the RIPE Database	`inetnum` objects	Assisted Registry Check
ARIN	Reassignments of a /29 or more must appear in WHOIS	SWIP or Rwhois	Organisation record review
APNIC	Assignments must be registered	`inetnum` objects	Resource review
LACNIC	Assignments must be registered	`inetnum` objects	Resource review
AFRINIC	Assignments must be registered	`inetnum` objects	Resource review

Confirm current thresholds and wording against the registry’s own policy documents before relying on them. Policy is revised regularly and each registry has its own process.

Two things are consistent across all of them. Undocumented space does not count as used — if a block is deployed but not registered, a utilization review treats it as free, and you will be told to use it before more is issued. And contact data is checked, because an abuse address that bounces is the most visible sign that a record is stale.

Establish what the registry currently holds

Start from the registry’s view rather than yours, because that is the version that gets audited.

For RIPE, query the database for objects under your maintainer. For ARIN, export from ARIN Online. For APNIC, use MyAPNIC. Either the portal or the database interface will give you the full list of inetnum, route, and contact objects associated with your resources.

Command-line equivalents are covered in WHOIS and RDAP.

Save this as a file. It is the baseline for every comparison that follows, and having it dated is useful when you need to show what changed.

Map registry objects to IPAM records

Match each registry object to an internal aggregate or assignment. Three categories come out.

Matched. Both sides agree on range, status, and holder. Nothing to do.

In IPAM, not in the registry. Space you have assigned but not published. This is the category that suppresses your measured utilization, and it is usually the largest one on a first pass.

In the registry, not in IPAM. Objects for assignments that ended, customers that left, or space that was reclaimed internally without the registry record being withdrawn. These inflate your apparent usage and, when they name a third party who no longer holds the space, they are actively misleading.

If your IPAM has an API, generate this comparison rather than doing it by eye. Even a script that prints the three lists is worth more than a careful manual pass, because it can be re-run.

Correct discrepancies in both directions

Publish what is missing. Withdraw what is obsolete.

The direction people neglect is withdrawal. Removing an inetnum for space that came back to your pool feels like housekeeping with no deadline, so it does not get done — and then a review counts that space as assigned to someone else while you are simultaneously arguing you need more.

When creating objects, be accurate about status. RIPE distinguishes ALLOCATED PA, ASSIGNED PA, ASSIGNED PI, SUB-ALLOCATED PA, and LEGACY; ARIN distinguishes direct allocations and assignments from reallocations and reassignments. These are not cosmetic labels — they determine how the space is treated in policy terms, and a wrong one is a finding.

Fix contact and abuse data

Verify that every abuse contact resolves to a mailbox someone reads, and that the technical contact is a person who still works there.

Send a test message to each abuse address. A bounce is a finding on its own in most registries, and an unmonitored mailbox is functionally the same as a bounce from the perspective of anyone trying to report an incident on your network.

Check that every resource object references the right contact objects. It is common for older objects to point at a role account created for a team that was reorganised years ago.

Automate the reconciliation

Run the comparison on a schedule — monthly is enough for most estates — and alert on the difference.

RIPE and APNIC both offer APIs against their databases, and ARIN has Reg-RWS. Combined with your IPAM’s API, that is enough to build the comparison without any manual export. Full automatic publication is a larger step and worth approaching carefully, because a script with write access to your registry objects can do a lot of damage quickly. A read-only comparison that produces a work list captures most of the value at a fraction of the risk.

Preparing for a specific request

When you are about to request additional space or complete a transfer, work through this before submitting:

Utilization is documented, not just real. Every deployed block has a corresponding registry object.
No obsolete objects remain. Space that returned to your pool is not still registered to a former customer.
Contacts are current and reachable. Tested, not assumed.
Statuses are correct. Allocation versus assignment, PA versus PI, matching what the space actually is.
Internal records support the numbers. If asked how a block is used, you can produce the assignment detail from IPAM in a form that matches what you published.

Registries generally raise discrepancies rather than refusing outright, but each round trip adds time — and transfers in particular have moving parts on both sides that do not wait patiently.

The leased-space exception

Address space you lease rather than hold has a different registration story: you are generally not the party who creates registry objects for it, and creating them without authorisation causes problems for the holder. Covered in IPAM for leased space.

WHOIS and RDAP — querying registry records
IPAM best practices — keeping internal records accurate
IPAM for leased space — space you do not hold
Address plan design — the utilization thresholds that trigger a request

Last updated on August 29, 2026

phpIPAM quickstart IPAM for leased space