January 2025 - NANOG - lists.nanog.org

Implementing Decentralized RPKI with Blockchain Technology
by Brandon Z. 20 Jan '25

20 Jan '25

Hi there, Currently, due to political factors, some countries are not particularly proactive in deploying RPKI. Imagine if the RIR of a region were forced to revoke all IP resources of a particular country from RPKI, effectively isolating that country from the global internet. To address this, one approach is for autonomous networks within a region to establish two trusted RPKI CA servers: one from the major RIRs and another locally managed. The locally managed CA would take precedence, allowing autonomous networks to submit their IP resources to the RPKI server of their peers (and potentially backed by a national mandate to trust this CA). This setup could prevent a scenario where an entire country’s IP resources are revoked, leading to all IPs being marked as invalid. Another concept is to use blockchain technology. While cryptocurrencies use computational power to verify ownership, BGP could use peer count. If an IP resource is marked as valid by a majority of high-influence networks (with many peers), it could be trusted by the entire internet. Could this approach work? Perhaps there’s existing research on similar methods? *Brandon Z.* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee of the text of the email message and virus.

17 43

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 17 Jan '25

17 Jan '25

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 18 Jan, 2025 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 972495 Prefixes after maximum aggregation (per Origin AS): 371325 Deaggregation factor: 2.62 Unique aggregates announced (without unneeded subnets): 472125 Number of IPv4 prefixes with a valid ROA: 519086 Number of IPv4 prefixes with an invalid ROA: 1374 Number of IPv4 prefixes with no ROA: 452035 Total ASes present in the Internet Routing Table: 76557 Prefixes per ASN: 12.70 Origin-only ASes present in the Internet Routing Table: 65512 Origin ASes announcing only one prefix: 26845 Transit ASes present in the Internet Routing Table: 11045 Transit-only ASes present in the Internet Routing Table: 530 Average AS path length visible in the Internet Routing Table: 5.2 Max AS path length visible: 142 Max AS path prepend of ASN (270417) 139 Prefixes from unregistered ASNs in the Routing Table: 1075 Number of instances of unregistered ASNs: 1080 Number of 32-bit ASNs allocated by the RIRs: 46086 Number of 32-bit ASNs visible in the Routing Table: 37677 Prefixes from 32-bit ASNs in the Routing Table: 198117 Number of bogon 32-bit ASNs visible in the Routing Table: 34 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 506 Number of addresses announced to Internet: 3119361152 Equivalent to 185 /8s, 237 /16s and 172 /24s Percentage of available address space announced: 84.3 Percentage of allocated address space announced: 84.3 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 318096 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 256162 Total APNIC prefixes after maximum aggregation: 76738 APNIC Deaggregation factor: 3.34 Prefixes being announced from the APNIC address blocks: 247988 Unique aggregates announced from the APNIC address blocks: 102483 APNIC Region origin ASes present in the Internet Routing Table: 14486 APNIC Prefixes per ASN: 17.12 APNIC Region origin ASes announcing only one prefix: 4428 APNIC Region transit ASes present in the Internet Routing Table: 1929 Average APNIC Region AS path length visible: 5.5 Max APNIC Region AS path length visible: 39 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9961 Number of APNIC addresses announced to Internet: 757828096 Equivalent to 45 /8s, 43 /16s and 138 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 286338 Total ARIN prefixes after maximum aggregation: 126933 ARIN Deaggregation factor: 2.26 Prefixes being announced from the ARIN address blocks: 288133 Unique aggregates announced from the ARIN address blocks: 134340 ARIN Region origin ASes present in the Internet Routing Table: 19211 ARIN Prefixes per ASN: 15.00 ARIN Region origin ASes announcing only one prefix: 7002 ARIN Region transit ASes present in the Internet Routing Table: 2011 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 39 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5114 Number of ARIN addresses announced to Internet: 1346425088 Equivalent to 80 /8s, 64 /16s and 209 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 270674 Total RIPE prefixes after maximum aggregation: 131237 RIPE Deaggregation factor: 2.06 Prefixes being announced from the RIPE address blocks: 267644 Unique aggregates announced from the RIPE address blocks: 170730 RIPE Region origin ASes present in the Internet Routing Table: 28835 RIPE Prefixes per ASN: 9.28 RIPE Region origin ASes announcing only one prefix: 12069 RIPE Region transit ASes present in the Internet Routing Table: 3994 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 43 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12210 Number of RIPE addresses announced to Internet: 733023104 Equivalent to 43 /8s, 177 /16s and 11 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 124020 Total LACNIC prefixes after maximum aggregation: 29048 LACNIC Deaggregation factor: 4.27 Prefixes being announced from the LACNIC address blocks: 121423 Unique aggregates announced from the LACNIC address blocks: 48840 LACNIC Region origin ASes present in the Internet Routing Table: 11195 LACNIC Prefixes per ASN: 10.85 LACNIC Region origin ASes announcing only one prefix: 2655 LACNIC Region transit ASes present in the Internet Routing Table: 2521 Average LACNIC Region AS path length visible: 5.9 Max LACNIC Region AS path length visible: 142 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9124 Number of LACNIC addresses announced to Internet: 177503488 Equivalent to 10 /8s, 148 /16s and 125 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 34226 Total AfriNIC prefixes after maximum aggregation: 6689 AfriNIC Deaggregation factor: 5.12 Prefixes being announced from the AfriNIC address blocks: 46801 Unique aggregates announced from the AfriNIC address blocks: 15304 AfriNIC Region origin ASes present in the Internet Routing Table: 1913 AfriNIC Prefixes per ASN: 24.46 AfriNIC Region origin ASes announcing only one prefix: 691 AfriNIC Region transit ASes present in the Internet Routing Table: 374 Average AfriNIC Region AS path length visible: 6.0 Max AfriNIC Region AS path length visible: 65 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1268 Number of AfriNIC addresses announced to Internet: 104319488 Equivalent to 6 /8s, 55 /16s and 202 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 10318 8754 92 CHINAMOBILE-CN China Mobile Communication 7545 6198 842 664 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4811 4192 76 ERX-CERNET-BKB China Education and Resear 9498 4109 526 276 BBIL-AP BHARTI Airtel Ltd., IN 7552 3909 1331 25 VIETEL-AS-AP Viettel Group, VN 7713 3676 1036 72 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3258 1869 101 VNPT-AS-VN VNPT Corp, VN 24560 2822 846 546 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2280 11518 582 KIXS-AS-KR Korea Telecom, KR 4755 2220 434 193 TATACOMM-AS TATA Communications formerly Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 12572 38854 3693 AMAZON-02, US 11492 4696 312 551 CABLEONE, US 7155 4176 287 86 VIASAT-SP-BACKBONE, US 174 4109 8763 880 COGENT-174, US 6327 3614 1320 81 SHAW, CA 22773 3383 3033 185 ASN-CXA-ALL-CCI-22773-RDC, US 749 3261 54895 2508 DNIC-AS-00749, US 16625 2932 1261 2150 AKAMAI-AS, US 396982 2899 3657 442 GOOGLE-CLOUD-PLATFORM, US 30036 2579 360 271 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7648 1709 143 UNI2-AS, ES 39891 4750 290 62 ALJAWWALSTC-AS, SA 20940 3957 3395 129 AKAMAI-ASN1, NL 9009 3738 321 1901 M247, RO 12389 2982 2301 888 ROSTELECOM-AS, RU 34984 2370 361 579 TELLCOM-AS, TR 212238 1897 136 1402 CDNEXT, GB 8452 1615 1852 14 TE-AS TE-AS, EG 13188 1607 100 26 TRIOLAN, UA 62240 1499 99 752 CLOUVIDER Clouvider - Global ASN, GB Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11620 3228 601 UNINET, MX 10620 3538 491 953 Telmex Colombia S.A., CO 13999 2523 538 373 Mega Cable, S.A. de C.V., MX 11830 1992 369 64 Instituto Costarricense de Electricidad y 28573 1332 2436 261 Claro NXT Telecomunicacoes Ltda, BR 3816 1329 778 207 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6503 1167 374 163 Axtel, S.A.B. de C.V., MX 11664 1149 278 33 Techtel LMDS Comunicaciones Interactivas 6147 1112 371 22 Telefonica del Peru S.A.A., PE 22884 1073 98 369 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1672 601 30 RAYA-AS, EG 24863 1648 389 18 LINKdotNET-AS, EG 29571 1542 97 105 ORANGE-COTE-IVOIRE, CI 36992 1425 1518 286 ETISALAT-MISR, EG 36903 1249 554 96 MT-MPLS, MA 36935 1001 521 42 Vodafone-, EG 20011 967 179 271 INTERNET-SOLUTIONS, ZA 37069 832 1083 15 MOBINIL, EG 6713 557 1861 35 IAM-AS, MA 36914 552 82 3 KENET-AS, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 12572 38854 3693 AMAZON-02, US 8151 11620 3228 601 UNINET, MX 9808 10318 8754 92 CHINAMOBILE-CN China Mobile Communication 12479 7648 1709 143 UNI2-AS, ES 7545 6198 842 664 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4811 4192 76 ERX-CERNET-BKB China Education and Resear 39891 4750 290 62 ALJAWWALSTC-AS, SA 11492 4696 312 551 CABLEONE, US 7155 4176 287 86 VIASAT-SP-BACKBONE, US 174 4109 8763 880 COGENT-174, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 8151 11620 11019 UNINET, MX 9808 10318 10226 CHINAMOBILE-CN China Mobile Communications Grou 12479 7648 7505 UNI2-AS, ES 7545 6198 5534 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4811 4735 ERX-CERNET-BKB China Education and Research Net 39891 4750 4688 ALJAWWALSTC-AS, SA 11492 4696 4145 CABLEONE, US 7155 4176 4090 VIASAT-SP-BACKBONE, US 7552 3909 3884 VIETEL-AS-AP Viettel Group, VN 9498 4109 3833 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 400866 UNALLOCATED 2.59.148.0/23 21859 ZEN-ECN, US 22542 UNALLOCATED 8.7.205.0/24 3356 LEVEL3, US 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.132.192.0/24 Origin: 30500 WOLFPAWSERVICES, CA 23.132.192.0/24 Transit: 6939 HURRICANE, US 23.140.16.0/24 Origin: 63371 RESERVED, ZZ 23.140.16.0/24 Transit: 10796 TWC-10796-MIDWEST, US 23.140.48.0/24 Origin: 63371 RESERVED, ZZ 23.140.48.0/24 Transit: 7018 ATT-INTERNET4, US 23.140.176.0/24 Origin: 40676 AS40676, US 23.140.176.0/24 Transit: 7922 COMCAST-7922, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:42 /11:93 /12:311 /13:588 /14:1219 /15:2149 /16:13981 /17:8308 /18:13781 /19:24794 /20:44670 /21:52500 /22:112511 /23:100700 /24:596121 /25:695 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6612 7648 UNI2-AS, ES 8151 5820 11620 UNINET, MX 11492 3555 4696 CABLEONE, US 39891 3441 4750 ALJAWWALSTC-AS, SA 6327 3410 3614 SHAW, CA 7155 3124 4176 VIASAT-SP-BACKBONE, US 22773 2519 3383 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2251 12572 AMAZON-02, US 30036 2240 2579 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2178 3538 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1654 2:1563 3:547 4:9 5:4473 6:165 7:6 8:1554 9:1 11:172 12:1387 13:354 14:2530 15:334 16:270 17:361 18:901 20:449 21:4 22:188 23:7236 24:2732 25:2 27:2630 29:19 31:3078 32:40 34:70 35:184 36:2412 37:4514 38:9044 39:894 40:150 41:4168 42:969 43:2509 44:347 45:18183 46:4948 47:295 49:2012 50:1864 51:587 52:1571 54:306 55:1027 56:8 57:235 58:2154 59:1246 60:1160 61:2797 62:2925 63:1841 64:5403 65:2200 66:4625 67:3007 68:1166 69:3997 70:1103 71:604 72:2857 74:2780 75:1635 76:635 77:2599 78:1849 79:1713 80:2226 81:2045 82:1864 83:1420 84:1799 85:3271 86:985 87:2436 88:1278 89:4343 90:751 91:8319 92:2753 93:2871 94:3844 95:4157 96:1269 97:309 98:981 99:737 100:71 101:1139 102:3478 103:32324 104:4590 105:751 106:1023 107:2607 108:1195 109:4067 110:2230 111:3389 112:2045 113:1539 114:1936 115:2157 116:2033 117:2699 118:2435 119:1931 120:1889 121:1413 122:2747 123:2166 124:1600 125:2874 126:62 128:1589 129:952 130:1253 131:1866 132:812 133:450 134:1509 135:322 136:1302 137:1150 138:2887 139:1568 140:1520 141:1484 142:1818 143:1607 144:1035 145:469 146:2137 147:2051 148:2583 149:2845 150:1188 151:1634 152:2090 153:499 154:7797 155:1541 156:3389 157:1855 158:1249 159:2440 160:3480 161:1786 162:3641 163:1782 164:1678 165:2158 166:1336 167:1866 168:4124 169:789 170:5084 171:1001 172:4019 173:3177 174:918 175:1265 176:3588 177:4966 178:3768 179:2241 180:2544 181:3961 182:3361 183:1834 184:2259 185:21366 186:5098 187:4347 188:4233 189:4106 190:9580 191:1552 192:11247 193:9359 194:7708 195:5438 196:3197 197:3508 198:6140 199:8301 200:8187 201:6316 202:10546 203:10514 204:4564 205:3687 206:4668 207:3614 208:4209 209:5140 210:4777 211:2621 212:4523 213:3738 214:1049 215:42 216:6582 217:3083 218:1388 219:538 220:2105 221:1053 222:852 223:2328 End of report

1 0

Looking for Peering Contact at AS16509
by W. Bontekoe 17 Jan '25

17 Jan '25

Hi, I'm trying to connect with someone responsible for managing peering relations in EU for AS16509 (Amazon). Unfortunately, several attempts to reach them via the address on peeringdb (peering-emea(a)amazon.com) have been unanswered. Greatly appreciate if an appropriate contact could kindly reach out to me off-list. -- W. Bontekoe Principal Site Reliability Engineer

1 0

RPKI's 2024 Year in Review
by Job Snijders 17 Jan '25

17 Jan '25

Dear all, Happy new year everyone! Having just closed the book on another orbit around the sun - let's look back at how RPKI did in 2024! In this memo I'll share some RPKI statistics, summarize highlights from the IETF Standards Development process, and reflect on emerging trends. Year to Year Growth of the distributed RPKI database =============================================================== A straightforward method to compare 2023 and 2024 is to look at the absolute numbers. The below table was constructed by comparing two December 31st RPKIviews.org snapshots [1] based on the the ARIN, AFRINIC, APNIC, LACNIC, and RIPE NCC Trust Anchors. 2023-12-31 2024-12-31 Total cache size (KiB): 1,546,728 2,021,784 (+31%) Total number of files (objects): 309,802 415,384 (+34%) Wall time validation run (seconds): 163 228 (+40%) Publication servers (FQDNs): 63 53 (-16%) Certification authorities: 40,511 44,935 (+11%) Route origin authorizations: 188,345 280,692 (+49%) Uniq VRPs: 497,341 639,909 (+29%) Average ROAIPAddresses per ROA: 2.7 2.3 (-15%) IPv4 addresses covered: 2,502,293,068 2,726,513,768 (+ 9%) Uniq IPv4 addresses covered: 1,502,281,680 1,658,281,248 (+10%) IPv6 addresses covered: 17,263 * 10^30 17,392 * 10^30 (+ 1%) Uniq IPv6 addresses covered: 15,128 * 10^30 15,139 * 10^30 (+ 0%) Uniq origin ASNs in ROAs: 40,656 47,282 (+16%) Uniq ASPA Customer ASIDs: 56 87 (+55%) The number of IPv4 addresses covered by ROAs saw similar growth compared to 2023. It's not entirely clear to me what's going on with IPv6, but on the IPv6 side of the house growth seems to be stalling. The NIST RPKI Deployment Monitor seems to corroborate these observations: https://rpki-monitor.antd.nist.gov/ROV/20250103.00/All/All/6#div2 As predicted in last year's review, nowadays more than half of both the IPv4 and IPv6 routes in the global routing system are covered by RPKI ROAs (~ 54%). Kentik estimates that around 74% of IP traffic is destined towards ROA covered destinations. These numbers mean it will be worth your while to create and use ROAs for BGP Origin Validation. This year's report includes new metrics: "Uniq ASPA Customer ASIDs", this field provides a simple indicator for global ASPA deployment on the signer side. At the moment about 0.001% of Autonomous Systems in the Internet global routing system published an ASPA record, so it's still very early days for ASPA! Another new metric is "Wall time validation run (seconds)". To produce this metric the two snapshots are processed through the same (modern) RPKI cache implementation on the same hardware omitting any network operations. This metric suggests that as the RPKI grows in size and/or number of files, processing time also increases. Please note that the wall time metric is not comparable between successive annual reports (for example, next year I might have a different laptop, or use a different validator implementation) - but within a single annual report the metric comparison is apples to apples. To reproduce: $ rpki-client -V rpki-client 9.3 $ time rpki-client -P 1704066710 -n -d rpki-20231231T235150Z/data /tmp/ $ time rpki-client -P 1735689171 -n -d rpki-20241231T235251Z/data /tmp/ Onwards to the next metric, "Average ROAIPAddresses per ROA" this shows how many IP prefixes, on average, are contained within a single ROA object. The higher the number of ROAIPAddresses per ROA, the higher computational efficiency is. "Efficiency" in this context arises from validators spending the computational cost of validating a single EE certificate and yielding more than 1 ROAIPAddress. Under the RIPE NCC TAL one yields 6.5 prefixes per ROA, while in the ARIN region this is number is 1.1 prefixes per ROA. As stewards of this technology, we need to keep an eye on the overall efficiency of the RPKI to ensure things don't get out of hand. SIDROPS - Working Group developments =============================================================== Some quick updates from the IETF working group responsible for development and maintenance of the RPKI technology stack! ASPA - where we at? ------------------- While most of the ASPA specification documents are steadily moving towards completion, the RPKI-To-Router (RTR) specification unfortunately appears to be progressing with great difficulty. With so many people excited about the prospect of using ASPA to prevent route leaks, it's sad to see a select few individuals dragging their feet to dot the i's and cross the t's. As things stand, some parts of the draft RTR specification are unimplementable and other parts appear underspecified. Perhaps appointment of an extra document editor would help? In last year's report I was more optimistic about the delivery timeline than I am this year. I now expect publication of the ASPA specs as RFCs not to happen earlier than 2026. For an overview of open action items, see: https://mailarchive.ietf.org/arch/msg/sidrops/fwPjecfnlU5JYi_hU-Sh3o7WRHQ/ Finished work ------------- The good news is that 2024 turned out to be a productive year in terms of tidying up various aspects of the RPKI technology stack. "Tidying up" in this context means resolving potentially detrimental system behavior for some edge cases, resolving underspecification in older documents, and documenting optimizations. A quick overview of RFC publications in the last 12 months: * RFC 9582 - A Profile for Route Origin Authorizations (ROAs) https://www.rfc-editor.org/rfc/rfc9582.html The new ROA specification clarifies the requirements for IP address and AS identifier X.509 certificate extensions, its ASN.1 notation was revised with additional backwards compatible constraints, errata were incorporated, and a canonicalization procedure was specified for the content of ipAddrBlocks. * RFC 9589 - On the Use of the CMS Signing-Time Attribute in RPKI Signed Objects https://www.rfc-editor.org/rfc/rfc9589.html 9589 describes mechanism for a 'cross-layer optimization' which enables Relying Parties (RPs) - when switching from RRDP to RSYNC - to save on bandwidth consumption. All five RIRs and rpki-client support this mechanism. See the following deep-dive for more information: https://blog.apnic.net/2023/12/04/using-timestamps-inside-rpki-objects-to-o… * RFC 9674 - Same-Origin Policy for the RRDP https://www.rfc-editor.org/rfc/rfc9674.html A potential security issue was discovered in RRDP: from one RRDP server references could be made to resources hosted on another RRDP server, causing RPs to follow the reference and waste bandwidth. The solution turned out to be simple: RPs should not follow references to resources hosted on other origins. All actively-maintained RPs implementations adopted this approach. * RFC 9697 - Detecting RRDP Session Desynchronization https://www.rfc-editor.org/rfc/rfc9697.html For RRDP to work well, once Delta files are published, Deltas are not expected to change over time. Delta files are immutable. A mechanism was devised for RPs to detect occurrences of unexpected file mutations and how to recover. Most actively-maintained RP implementations adopted this approach. Final words =============================================================== RPKI has become the #1 tool in the toolbox to prevent routing incidents. Implementing RPKI allows operators to improve network reliability by strengthening the security and integrity of the global Internet routing system. I'm excited to see what the coming year will bring! Kinds regards, Job Snijders Data sources: RPKI Views - http://rpkiviews.org/ https://dango.attn.jp/rpkidata/2023/12/31/rpki-20231231T235150Z.tgz https://dango.attn.jp/rpkidata/2024/12/31/rpki-20241231T235251Z.tgz

1 0

Edgio Bankruptcy - Services cut-off
by Pacheco, Matheus 17 Jan '25

17 Jan '25

Hi Nanog Anybody here still using services with Edgio that have some details (or any sort of information) regarding the services cut-off that was suppose to happen today ? I heard from a former Edgio partner that the cut-off was postponed to tomorrow, but not much info than that. Ive tried to contact Akamai to get and they are unresponsive. Cheers, -- Matheus Pacheco Triton Digital | Montreal

5 4

US executive order forces all US goverment resoruces to be with ARIN/etc?
by Ben Cartwright-Cox 17 Jan '25

17 Jan '25

Still reading this very word dense executive order that came out recently: https://www.whitehouse.gov/briefing-room/presidential-actions/2025/01/16/ex… I did notice however that it has: > (i) Within 90 days of the date of this order, FCEB agencies shall take steps to ensure that all of their assigned Internet number resources (Internet Protocol (IP) address blocks and Autonomous System Numbers) are covered by a Registration Services Agreement with the American Registry for Internet Numbers or another appropriate regional Internet registry. I don't have numbers on hand for how much US Gov space is already with ARIN, but this seems like a pretty nice win for ARIN getting an order for the US Gov legacy space attached to them (mentioned by name), while other RIRs are available in that order, I don't imagine it's going to other RIRs :)

6 9

Re: Seeking AS36351 Softlayer Contact
by Aaron Atac 16 Jan '25

16 Jan '25

Thanks, all. Jan 16, 2025 at 2:56 PM by nanog(a)nanog.org: > Seeking AS36351 Softlayer contact > > -Aaron >

1 0

AT&t ABF NYC
by Robert DeVita 16 Jan '25

16 Jan '25

FYI. AT&T is discontinuing their ABF service in New York. What's Happening with Existing ABF Customers in NY AT&T Business Fiber customers in New York will be able to keep their current ABF service until March 1 at no charge, as they find other options for broadband service. Customers must do one of the following before 3/1/25, when their ABF services will be disconnected: * Sign a 12-month contract for existing ABF services at current rates * Switch to AT&T Dedicated Internet (ADI) or AWB with standard pricing * Take no action, and their ABF services will be disconnected on 3/1/25 Existing customers are being contacted via email and direct mail to inform them of the changes and offer the option to either sign a 12-month contract or migrate to AWB or ADI. AT&T’s nationwide wireless service will not change in New York. AIA-B and ABF are still offered in all other qualified locations and states. We value our customers and AT&T will continue to support policies that promote capital investment, innovation and a competitive market. Get Outlook for iOS<https://aka.ms/o0ukef>

9 13

Seeking AS36351 Softlayer Contact
by Aaron Atac 16 Jan '25

16 Jan '25

Seeking AS36351 Softlayer contact -Aaron

1 0

RE: cloudflare timeout errors (from edge itself)
by Dmitry Sherman 16 Jan '25

16 Jan '25

Funny thing is that cloudflare so far didn’t solve it and closed the case. We tried changing routes didn’t help. Nobody answers from their side Dmitry Sherman Interhost Networks T: +972.74.702.9881 M: +972.54.318.1182 E: dmitry(a)interhost.net<mailto:dmitry@interhost.net> W: interhost.co.il<https://www.interhost.co.il/> [Logo]<https://www.interhost.co.il/> From: Dmitry Sherman Sent: Wednesday, 1 January 2025 23:05 To: NANOG <nanog(a)nanog.org> Subject: cloudflare timeout errors (from edge itself) Hello, Anyone from CloudFlare? I have timeout errors from cloudflare servers (not from origin like 520) but from cloudflare itself, randomally everyday for 10 minutes for many domains under the account in same time. Thanks Dmitry

1 0