Dear all,
On the #DENOG IRC channel I was asked for current stats on the number of
RPKI-invalid IRR route/route6 objects in various databases as follow-up
to a talk at RIPE81 [0]. I figured I should share this with the WG too.
Below is a table with today's stats of number of invalid route/route6
objects when one applies the RFC 6811 origin validation algorithm with
as input prefix value in the "route:" attribute and the origin AS in the
"origin:" attribute.
invalids invalids
AFRINIC: ipv4: 359 - ipv6: 12 - authoritive
ALTDB: ipv4: 1 - ipv6: 191 - note 4
APNIC: ipv4: 21861 - ipv6: 1880 - authoritive
ARIN: ipv4: 814 - ipv6: 65 - authoritive
BBOI: ipv4: 44 - ipv6: 1
BELL: ipv4: 322 - ipv6: 0
JPIRR: ipv4: 95 - ipv6: 4
LACNIC: ipv4: 0 - ipv6: 0 - authoritive (note 3)
LEVEL3: ipv4: 12925 - ipv6: 182
NTTCOM: ipv4: 65513 - ipv6: 730
RADB: ipv4: 208901 - ipv6: 12829
RGNET: ipv4: 2 - ipv6: 0
RIPE: ipv4: 28390 - ipv6: 3518 - authoritive
RIPE-NONAUTH: ipv4: 5 - ipv6: 0 - note 5
TC: ipv4: 0 - ipv6: 0 - note 2
Some notes on the above table:
1) ARIN-NONAUTH is not listed, ARIN deprecated this IRR source a month
ago [2].
2) TC achieved a perfect 0/0 score by using the IRRd v4 RPKI integration
[3].
3) LACNIC's IRR service is an information proxy for RPKI ROAs valid
under the LACNIC Trust Anchor. This by definition means that all IRR
objects in the LACNIC IRR database are RPKI-valid.
4) ALTDB periodically runs a script to delete RPKI-invalid objects
5) RIPE-NONAUTH imposes a two week delay before deleting RPKI-invalid
objects, so the 5 IPv4 objects currently marked as invalid with
disappear in the next few days, unless the covering RPKI ROAs are
withdrawn before the timer expires.
The stats are generated by downloading the IRR database dump for each
source and running a simple python script [1].
Kind regards,
Job
[0]: https://ripe81.ripe.net/presentations/59-IRRd-RIPE812.pdf
[1]: https://github.com/job/irr-nonauth-cleanup
[2]: https://www.arin.net/announcements/20220128-irr/
[3]: https://irrd.readthedocs.io/en/stable/admins/rpki/
--
To unsubscribe from this mailing list, get a password reminder, or change your
subscription options, please visit:
https://lists.ripe.net/mailman/listinfo/routing-wg
