Advancing Internet Technologies in South East Europe

Our research builds upon findings discussed at the last two SEE meetings where we explored the early development of Internet connectivity and the evolution of telecommunication markets. With consolidation being a major factor in the way these markets have evolved, we observed a significant decrease in the number of small operators due to mergers and acquisitions, leaving only a handful of major operators present in each country. Overall though, Internet usage and coverage have been going up and investment flow is increasing. In our research, we identified some of the big players and their role in country routing and IPv6 uptake, but also looked at overall dynamics of these technologies over time.

SEE IPv6 uptake

The Internet community has been quite vocal about the limitations of IPv4 and the need for a transition to IPv6 for many years - but getting that message across has not been easy and adoption has proceeded at a slow pace since IPv6 became a standard in 1998.

Today, though, with recent changes in the IPv4 market - e.g. the new AWS public IPv4 policy - and with more governments announcing plans to shift to IPv6-only - e.g. US, China, India, Czechia, Belarus - the call for IPv6 adoption is resonating more clearly than ever with wider business interests.

In the RIPE NCC Survey 2023, more than half of respondents from South East Europe reported that they have deployed IPv6 in their networks, with the need to be 'future-ready' the most commonly cited reason for making the shift from IPv4. That said, respondents also pointed to continuing barriers to deployment, such as improvements in feature parity between IPv4 and IPv6, and ongoing challenges in coaxing decision makers out of the IPv4 mindset.

With these findings in mind, to examine how much change has actually occurred over time in the region as a whole, we analysed the uptake of IPv6 from two perspectives: IPv6 allocations and IPv6 routing.

IPv6 Allocations

Getting a view of the number of IPv6 allocations in a country is important for understanding the dynamics of IPv6 adoption. We observed that allocations are often proportional to the number of active Local Internet Registries (LIRs) for each country.

Romania and Bulgaria, for example, have significantly higher amounts of active LIRs when compared to other SEE countries and also lead by a wide margin when it comes to number of IPv6 allocations. For both countries, the highest growth was seen in 2017 to 2021, with the increase in number of LIRs being almost certainly driven by a change in RIPE policy that occurred after reaching the last /8 of IPv4 address space in 2012 (after that time, smaller organisations no longer received IPv4 from a sponsoring LIR but instead had to become an LIR themselves or turn to the secondary market - more information on this is in the RIPE NCC Internet Country Report: Bulgaria, Moldova and Romania).

Interestingly, Bulgaria has only about a quarter of Romania's population (see figure 2 below), but a disproportionately higher number of active LIRs. Exploring the reasons behind these differences falls beyond the scope of this article, but we hope to get more insights into the higher numbers of allocated IPv6 addresses and LIR counts, particularly in Bulgaria and Romania, from the community at SEE 12.

Please note: country codes in the RIPE Database (registry information) follow the ISO 3166-1 list for officially assigned country codes. Members in Kosovo are typically registered under the Albania country code (AL), but some are registered under the Serbian country code (RS). This is reflected in all data analysed for this article.

IPv6 Capability

On average, the percentage of IPv6-capable ASNs (defined here as the % of ASNs routing at least one IPv6 prefix) remains low in the region (around 25%) compared to the EU average (around 39%) as of April 2024 (see figure 3).

We measured IPv6 capability (the percentage of IPv6-capable ASNs) by examining if allocated IPv6 prefixes are actively announced in global routing tables. Given the vast size of the IPv6 address space, merely counting addresses would not provide a meaningful metric. Instead, we focus on the advertisement of prefixes by Autonomous Systems (ASes) as a key indicator of IPv6 capability and progress.

To assess this, we analysed weekly data dumps from the Routing Information Service (RIS), focusing on ASes that announce both IPv4 and IPv6 prefixes. We mapped these ASes to their respective countries of registration using RIR statistics. This helped us understand how IPv6 is integrated alongside existing IPv4 networks. We then calculated the percentage of ASes in each country that announce both types of addresses, as well as those that announce only IPv6, compared to those that announce only IPv4. This indicator provides insight into the extent of IPv6 capability and progress across various regions. It is important to note that some ASes operate in multiple countries, however we only consider the country of registration for our analysis.

Additionally, while IPv6 capability indicates that addresses are being routed, this does not necessarily equate to adoption. Addresses may appear in global routing tables but might not be actively utilised internally by providers. Therefore, IPv6 capability should be viewed as an initial step toward broader adoption.

We observe that Greece - the host country for SEE 12 - has a diverse connectivity landscape with a notably high IPv6 capability level of around 40% (as of April 2024), which matches the EU average. In February-March 2020, Greece saw a spike in IPv6 capability with around 11 ASes starting to announce their v6 space. We found out that this spike was caused by some academic networks starting to announce their IPv6 space in the routing tables (see figure 4).

The overall percentage of IPv6 capability for countries in the region varies with difference in the number of resources (ASNs). This dynamic is also reflected in the membership. For example, Romania seems to have low IPv6 capability but also has a higher volume of allocations (# of members: 168) in comparison to, for example, Montenegro that has only 17 members.

The overall IPv6 capability among the countries in South East Europe as of April 2024 varies between 14% to 40% with Greece being on top matching with the average EU score. While some countries such as Romania, Bulgaria and Serbia are below regional average capability score (25%). As we conclude, the capability varies a lot based on country IPv6 resources, and the region will benefit from acceleration of IPv6 uptake as this technology becomes crucial for supporting the expanding internet of things, enhancing security features, and improving network efficiency and performance.

Routing security and the role of RPKI

RPKI is a security framework that helps network operators make more informed and secure routing decisions. Route Origin Authorisation (ROA) is the first step on users' RPKI journey while Route Origin Validation (ROV) validates the announcements and prevents hijacking.

ROA is a digitally signed object that specifies which autonomous systems (ASes) are authorised to announce specific IP prefixes. This authorisation is critical as it establishes a verified link between IP addresses and the ASes permitted to announce them. It effectively serves as the first significant step in a user's RPKI journey.

ROA coverage in South East Europe, overall, is growing steadily for both IPv4 and IPv6 space (see figure 5 below). The IPv6 coverage is lower because most LIRs receive similar allocation sizes, with 95% of LIRs in the region having at most two /29 allocations. In contrast, the distribution of IPv4 allocations varies more, with large broadband and mobile providers holding significant portions. To increase IPv6 ROA coverage, smaller organisations need to cover their resources with ROA.

According to the results of the RIPE NCC Survey 2023, for 52% of the respondents from South East Europe the main reason for not implementing RPKI is not being familiar with RPKI. Knowledge gap can often be the main obstacle in adopting new technologies. The RIPE NCC offers a variety of courses, trainings and webinars to familiarise network professionals with RPKI.

If you wish to learn more about RPKI check out courses and microlearnings on RPKI in the RIPE NCC Academy.

We also zoomed in Greece (see figure 6 below) to see the percentage of IPv4 and IPv6 space that is covered by ROAs from all IPv4 and IPv6 address space that is registered in Greece.

While the ROA coverage for IPv6 grew steadily, IPv4 space saw higher spikes in some specific moments. The biggest of these occurs in April 2017, when Greek operator OTE covered their 1.8 million addresses with ROAs resulting in 35% increase in ROA coverage in the country. Please note that address space might be used outside Greece as the records only indicate registration under the Greece country code.

ROAs establish the legitimacy of route origins. However, without ROV, it's impossible to fully ensure the integrity and security of routing decisions within the BGP. ROV verifies that the route announcements adhere to the authorisations specified by ROAs.

We analysed the deployment of ROV across SEE using RoVISTA that calculates the scores based on the number of RPKI-invalid prefixes that an AS can reach. In this article, we have adopted a more inclusive approach where we classify an AS as having implemented ROV if its score is greater than 0, indicating any level of ROV deployment. In future work, we plan to refine our methodology by incorporating datasets from additional sources. This will enhance our coverage and help reduce false positives.

Additionally, we assessed ROV impact from the perspective of network centrality, utilising the AS Hegemony methodology, which measures the centrality of autonomous systems within a country. This methodology measures the common transit networks to a local AS and how much this AS relies on these transit networks based on BGP data.

AS hegemony values range between 0 and 1 and indicate the average fraction of paths crossing a node. If, for instance, there are a few ASes with a hegemony close to 1, it implies most paths to ASes in the country pass through these central ASes. Note that the plot only shows ASes that have high hegemony values and excludes the ASes with hegemony value less than 0.1.

The deployment of Route Origin Validation (ROV) by centrally connected networks is crucial not only for their own security, but also for the protection of their customers. When large (central) ASNs implement ROV, they inherently safeguard smaller, directly connected networks against routing threats like BGP hijacking. This collateral benefit signifies the importance of ROV adoption by major network operators to enhance the overall security ecosystem of interconnected networks.

The hegemony plots below show the interconnectivity 'map' in some of the SEE countries as of 1 March 2024 with each node representing an AS - they are classified by in-country (local) and out-of-country (foreign) registered ASes. The larger the node, the higher its hegemony value. The colour codes represent the ROV deployment in each AS. When looking at which networks appear along those paths, some show up much more frequently than others, indicating that they play a more important or central role in routing for the relevant country.

In Greece, GRNET (AS5408), national infrastructure for research and technology, has high hegemony value and implemented ROV. Another example of local networks implementing ROV is OTE (AS6799). It is important to note that the RIS data relies on country code registrations that can cause errors. For example, legacy ASN of a Greek provider NOVA (AS1241) is registered under “EU” country code, thus displayed as “foreign AS” in the plot below.

However, there are some central networks that haven’t implemented ROV. Vodafone Greece (AS3329) seems to not implement ROV. This also applies to Vodafone’s global AS (AS1273). Digital Realty Hellas (AS56910) has also high centrality in routing tables in Greece and hasn’t implemented ROV.

There are some Tier 1 networks that have high network centrality and deploy ROV enhancing security and stability of the Internet routing infrastructure (Hurricane Electric: AS6939, Cogent: AS174, etc.)

The connectivity landscape varies across the countries in the region. While Bulgaria and Romania can be characterised by a vast number of ASNs in routing, Montenegro and Bosnia and Herzegovina have fewer ASNs operating in the country. Most of the central networks in Montenegro (both foreign and local) are not implementing ROV. The largest telecom company in the country Crnogorski Telekom (AS8585) is the only local AS implementing ROV from the data available.

Overall, it is evident that implementing RPKI is very important for large networks as they play a central role in countries' routing.

Technology moving forward

As the South East Europe community gathers in Athens to discuss regional advancements in Internet technology, it's evident that while strides have been made in IPv6 deployment and routing security, there remains a significant disparity in technology adoption rates across the region. Greece showcases a commendable level of IPv6 adoption, aligning with EU averages, yet the overall regional uptake is behind, emphasising the need for broader deployment. In this article, we highlighted the role of major networks in adopting and enhancing routing security protocols like ROV to prevent vulnerabilities that can affect the entire network ecosystem.

Moving forward, it is crucial for those who run the Internet to focus on overcoming the barriers to IPv6 adoption and enhancing routing security to ensure a resilient and forward-looking Internet infrastructure. We invite the SEE Internet community to provide their input on this analysis.

Do you want to join us at SEE 12 in Athens? You can still register for the event at: https://www.ripe.net/membership/meetings/regional-meetings/see/see-12/