Towards cleaning up RPKI INVALIDs

Figure 1: An example of a ROA

Motivation

INVALIDs we do NOT care about

Figure 2: Less-specific covers for more-specific
Figure 3: Equally-specific prefix-origin pair is availalbe
Figure 4: Multiple more-specific cover for INVALID less-specific (100% overlap)
Figure 5: Example of a partially (50%) reachable prefix

Distribution of INVALIDs by RIR

Break Down by Reason

Affected Prefix-Origin Pairs  Reason
1338 INVALID_ASN
1077 INVALID_LENGTH

Break Down by RIR and Reason

 693 LACNIC INVALID_ASN
509 LACNIC INVALID_LENGTH
404 RIPE INVALID_ASN
334 APNIC INVALID_LENGTH
203 RIPE INVALID_LENGTH
193 APNIC INVALID_ASN
47 ARIN INVALID_ASN
31 ARIN INVALID_LENGTH
1 AfriNIC INVALID_ASN

Break down by announcing AS (top 10)

 180 AS14080
128 AS23650
111 AS52308
79 AS22080
64 AS35104
59 AS43554
52 AS52228
51 AS10299
46 AS264797
38 AS45774

Which ROAs cause most INVALIDs?

 91 LACNIC  AS60458 181.214.0.0/15 24
78 LACNIC AS37692 191.96.0.0/16 24
62 LACNIC AS61440 191.101.0.0/16 24
59 APNIC AS23650 61.160.0.0/16 16
54 RIPE AS43554 5.105.0.0/16 16
52 LACNIC AS52228 152.231.128.0/17 17
41 APNIC AS4809 115.168.0.0/14 14
39 APNIC AS23650 61.155.0.0/16 16
37 LACNIC AS22080 200.112.128.0/19 19
35 APNIC AS23650 61.147.0.0/16 16
32 RIPE AS43343 78.158.160.0/19 19
30 LACNIC AS52308 190.108.32.0/19 19
30 LACNIC AS52308 181.114.192.0/19 19
30 LACNIC AS33182 179.61.128.0/17 24
30 APNIC AS45774 49.213.32.0/19 19
29 LACNIC AS22080 200.112.160.0/19 19
29 LACNIC AS10986 190.114.96.0/19 22
27 LACNIC AS52308 181.174.128.0/19 19
23 LACNIC AS10620 190.147.0.0/16 24
21 LACNIC AS7195 200.25.0.0/17 17

Notifying affected IP Holders

An approximation of how many members each RIR would have to contact to fix INVALIDs.

Future Steps

Acknowledgements and Disclaimers

Data

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store