March 2026 - NANOG - lists.nanog.org

fcc.gov DNS SPF record broken
by Mukund Sivaraman 09 Mar '26

09 Mar '26

If any DNS admins at FCC.gov are reading this message, would you please look at the following issue? I filed a servicenow ticket with FCC, but it was resolved with an unrelated resolution that they received payment, so I'm mentioning it here so that someone looks at it. FCC licensing requires a valid email address to be maintained with them; due to an incorrect SPF configuration for fcc.gov, emails can be rejected by recepient MTAs which check SPF such as: Mar 7 14:47:57 mx postfix/smtpd[9936]: NOQUEUE: reject: RCPT from mail-westusazlp170110001.outbound.protection.outlook.com[2a01:111:f403:c001::1]: 550 5.7.24 <muks(a)mukund.org>: Recipient address rejected: Message rejected due to: SPF Permanent Error: No valid SPF record for included domain: spf-0024ed01.pphosted.com: include:spf-0024ed01.pphosted.com. Please see http://www.openspf.net/Why?s=mfrom;id=fccregistration@fcc.gov;ip=2a01:111:f…; from=<FCCRegistration(a)fcc.gov> to=<muks(a)mukund.org> proto=ESMTP helo=<BY5PR09CU001.outbound.protection.outlook.com> [muks@p5 ~]$ dig -t TXT spf-0024ed01.pphosted.com ; <<>> DiG 1.99.10.19700101000000.000000000 <<>> -t TXT spf-0024ed01.pphosted.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 29973 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;spf-0024ed01.pphosted.com. IN TXT ;; AUTHORITY SECTION: pphosted.com. 10 IN SOA ns1.proofpoint.com. ops.proofpoint.com. 2026211855 1200 120 2419200 600 ;; Query time: 3 msec ;; SERVER: 172.17.5.4#53(172.17.5.4) ;; WHEN: Mon Mar 09 19:01:35 GMT 2026 ;; MSG SIZE rcvd: 109 [muks@p5 ~]$ Mukund

1 0

Spoofer Report for NANOG for Feb 2026
by CAIDA Spoofer Project 08 Mar '26

08 Mar '26

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Feb 2026: ASN Name Fixed-By 13781 ENERGYNET 2026-02-23 33711 IP-TELECOM 2026-02-27 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Feb 2026: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2026-02-28 27364 ACS-INTERNET 2016-09-27 2026-02-03 22883 CONDENAST 2019-05-29 2026-02-24 21804 ACCESS-SK 2019-06-09 2026-02-24 52643 N&G Tecnologia LTDA 2019-09-24 2026-02-23 393397 LREC-LRT 2020-08-02 2026-02-08 36352 AS-COLOCROSSING 2020-10-08 2026-02-27 55016 IMPER-AS-1 2021-05-18 2026-02-22 22773 ASN-CXA-ALL-CCI-22773-RDC 2021-10-24 2026-02-25 12183 TALKIE-COMMUNICATIONS 2022-12-10 2026-02-28 400282 2023-04-27 2026-02-28 393577 SCCNET 2023-05-03 2026-02-27 394684 AS-GOLD 2024-01-17 2026-02-28 27425 ASN-IDK-27425 2024-02-21 2026-02-23 53755 IOFLOOD 2024-02-23 2026-02-28 393530 TLU 2024-05-22 2026-02-25 19935 CRRS 2024-05-29 2026-02-20 265561 LANTOINTERNET SA DE CV 2024-09-06 2026-02-27 273143 2025-01-22 2026-02-25 54334 ROYA 2025-03-13 2026-02-27 273843 2025-04-02 2026-02-26 6134 XNNET 2026-02-12 2026-02-12 212238 CDNEXT 2026-02-18 2026-02-25 47046 2026-02-26 2026-02-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Re: How long AS-PATH policies have you used
by Jakob Heitz (jheitz) 07 Mar '26

07 Mar '26

That was fixed in IOS-XR about 5 years ago. Previously, we could only do it with as-path-set in route-policy. as-path-set allows whole paths to be specified, so it's slow. If all you want is to match on a single ASN, it can be done much faster using a tree lookup instead of linear. So, I invented the as-set for route-policy configuration. Here is a config sample: as-set asset1 2914, 174, 3356 end-set ! route-policy asd if as-path originates-from asset1 then pass endif end-policy If that doesn't meet your needs, let me know. Kind Regards, Jakob Heitz Date: Tue, 24 Feb 2026 20:15:00 +0200 From: Saku Ytti <saku(a)ytti.fi> For SROS, IOSXR 90k would be quite a ridiculous attempt, and it's probably cheaper just to expand to a million lines of prefix-list, since prefix-list scale is more tested than AS_PATH scale. In SROS as-path-group can contain only 128 lines, so if you match a single ASN per line, you'd need 700 terms just to check the origin, unless you use regexp OR in the lines to put multiple origins per line.

2 1

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 06 Mar '26

06 Mar '26

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 07 Mar, 2026 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 1039688 Prefixes after maximum aggregation (per Origin AS): 397860 Deaggregation factor: 2.61 Unique aggregates announced (without unneeded subnets): 510556 Number of IPv4 prefixes with a valid ROA: 621178 Number of IPv4 prefixes with an invalid ROA: 1405 Number of IPv4 prefixes with no ROA: 417105 Total ASes present in the Internet Routing Table: 78095 Prefixes per ASN: 13.31 Origin-only ASes present in the Internet Routing Table: 67104 Origin ASes announcing only one prefix: 27331 Transit ASes present in the Internet Routing Table: 10991 Transit-only ASes present in the Internet Routing Table: 555 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 69 Max AS path prepend of ASN (269326) 61 Prefixes from unregistered ASNs in the Routing Table: 1109 Number of instances of unregistered ASNs: 1148 Number of 32-bit ASNs allocated by the RIRs: 48973 Number of 32-bit ASNs visible in the Routing Table: 40048 Prefixes from 32-bit ASNs in the Routing Table: 223359 Number of bogon 32-bit ASNs visible in the Routing Table: 116 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 436 Number of addresses announced to Internet: 3114600192 Equivalent to 185 /8s, 165 /16s and 7 /24s Percentage of available address space announced: 84.1 Percentage of allocated address space announced: 84.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 337680 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 285091 Total APNIC prefixes after maximum aggregation: 82267 APNIC Deaggregation factor: 3.47 Prefixes being announced from the APNIC address blocks: 272349 Unique aggregates announced from the APNIC address blocks: 107149 APNIC Region origin ASes present in the Internet Routing Table: 15127 APNIC Prefixes per ASN: 18.00 APNIC Region origin ASes announcing only one prefix: 4656 APNIC Region transit ASes present in the Internet Routing Table: 1995 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10670 Number of APNIC addresses announced to Internet: 752959360 Equivalent to 44 /8s, 225 /16s and 63 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 304555 Total ARIN prefixes after maximum aggregation: 136688 ARIN Deaggregation factor: 2.23 Prefixes being announced from the ARIN address blocks: 303358 Unique aggregates announced from the ARIN address blocks: 147219 ARIN Region origin ASes present in the Internet Routing Table: 19411 ARIN Prefixes per ASN: 15.63 ARIN Region origin ASes announcing only one prefix: 7094 ARIN Region transit ASes present in the Internet Routing Table: 1924 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 26 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5502 Number of ARIN addresses announced to Internet: 1352851712 Equivalent to 80 /8s, 162 /16s and 225 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 285279 Total RIPE prefixes after maximum aggregation: 140844 RIPE Deaggregation factor: 2.03 Prefixes being announced from the RIPE address blocks: 287779 Unique aggregates announced from the RIPE address blocks: 186610 RIPE Region origin ASes present in the Internet Routing Table: 29298 RIPE Prefixes per ASN: 9.82 RIPE Region origin ASes announcing only one prefix: 12164 RIPE Region transit ASes present in the Internet Routing Table: 3989 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 13124 Number of RIPE addresses announced to Internet: 733469824 Equivalent to 43 /8s, 183 /16s and 220 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 126809 Total LACNIC prefixes after maximum aggregation: 30384 LACNIC Deaggregation factor: 4.17 Prefixes being announced from the LACNIC address blocks: 122521 Unique aggregates announced from the LACNIC address blocks: 49700 LACNIC Region origin ASes present in the Internet Routing Table: 11356 LACNIC Prefixes per ASN: 10.79 LACNIC Region origin ASes announcing only one prefix: 2683 LACNIC Region transit ASes present in the Internet Routing Table: 2534 Average LACNIC Region AS path length visible: 5.4 Max LACNIC Region AS path length visible: 69 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9371 Number of LACNIC addresses announced to Internet: 170958336 Equivalent to 10 /8s, 48 /16s and 158 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-275868 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 36845 Total AfriNIC prefixes after maximum aggregation: 6964 AfriNIC Deaggregation factor: 5.29 Prefixes being announced from the AfriNIC address blocks: 53245 Unique aggregates announced from the AfriNIC address blocks: 19490 AfriNIC Region origin ASes present in the Internet Routing Table: 2017 AfriNIC Prefixes per ASN: 26.40 AfriNIC Region origin ASes announcing only one prefix: 734 AfriNIC Region transit ASes present in the Internet Routing Table: 385 Average AfriNIC Region AS path length visible: 5.3 Max AfriNIC Region AS path length visible: 63 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1381 Number of AfriNIC addresses announced to Internet: 103118080 Equivalent to 6 /8s, 37 /16s and 117 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 13815 8945 105 CHINAMOBILE-CN China Mobile Communication 7545 5988 831 539 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5026 4193 77 ERX-CERNET-BKB China Education and Resear 9498 4844 547 333 BBIL-AP BHARTI Airtel Ltd., IN 18403 4558 347 24 FPT-AS-AP FPT Telecom Company, VN 7552 4047 1332 29 VIETEL-AS-AP Viettel Group, VN 7713 3658 1044 65 TELKOMNET-AS-AP PT Telekomunikasi Indones 56046 3466 887 178 CMNET-JIANGSU-AP China Mobile communicati 45899 3339 1868 99 VNPT-AS-VN VNPT Corp, VN 24560 2988 864 509 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14449 41235 5573 AMAZON-02 - Amazon.com, Inc., US 22773 4784 3119 372 ASN-CXA-ALL-CCI-22773-RDC - Cox Communica 11492 4641 308 1017 CABLEONE - CABLE ONE, INC., US 7155 3861 286 85 VIASAT-SP-BACKBONE - ViaSat,Inc., US 6327 3708 1321 75 SHAW - Shaw Communications, CA 174 3498 8768 859 COGENT-174 - Cogent Communications, LLC, 396982 3298 4856 484 GOOGLE-CLOUD-PLATFORM - Google LLC, US 749 3141 54728 2392 DNIC-AS-00749 - United States Department 16625 2725 1187 2101 AKAMAI-AS - Akamai Technologies, Inc., US 36352 2703 222 892 AS-COLOCROSSING - HostPapa, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7230 1711 149 UNI2-AS, ES 39891 4969 306 72 ALJAWWALSTC-AS, SA 20940 3839 3393 113 AKAMAI-ASN1, NL 9009 3825 355 2246 M247, RO 12389 3175 2321 873 ROSTELECOM-AS PJSC Rostelecom. Technical 212238 2665 193 1952 CDNEXT, GB 34984 2462 366 573 TELLCOM-AS, TR 8452 1699 1852 17 TE-AS TE-AS, EG 203020 1614 243 786 HOSTROYALE, IN 13188 1607 100 27 TRIOLAN, UA Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12778 3301 593 UNINET, MX 10620 3453 458 1104 Telmex Colombia S.A., CO 13999 2455 506 349 Mega Cable, S.A. de C.V., MX 11830 1958 369 65 Instituto Costarricense de Electricidad y 11664 1453 278 33 Techtel LMDS Comunicaciones Interactivas 28573 1371 2430 272 Claro NXT Telecomunicacoes Ltda, BR 3816 1342 770 213 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6147 1250 371 22 INTEGRATEL PERU S.A.A., PE 26615 1060 2475 94 TIM SA, BR 22884 1059 67 360 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 2044 648 34 RAYA-AS, EG 36992 1847 1532 340 ETISALAT-MISR, EG 24863 1289 389 16 LINKdotNET-AS, EG 36903 1232 555 98 MT-MPLS, MA 36935 1228 520 43 Vodafone-, EG 37069 1117 1112 11 MOBINIL, EG 29571 1073 78 20 ORANGE-COTE-IVOIRE, CI 20011 580 154 212 NTT-DATA-Inc, ZA 36914 560 82 3 KENET-AS, KE 328608 552 46 165 Africa-on-Cloud-AS, ZA Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14449 41235 5573 AMAZON-02 - Amazon.com, Inc., US 9808 13815 8945 105 CHINAMOBILE-CN China Mobile Communication 8151 12778 3301 593 UNINET, MX 12479 7230 1711 149 UNI2-AS, ES 7545 5988 831 539 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5026 4193 77 ERX-CERNET-BKB China Education and Resear 39891 4969 306 72 ALJAWWALSTC-AS, SA 9498 4844 547 333 BBIL-AP BHARTI Airtel Ltd., IN 22773 4784 3119 372 ASN-CXA-ALL-CCI-22773-RDC - Cox Communica 11492 4641 308 1017 CABLEONE - CABLE ONE, INC., US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 13815 13710 CHINAMOBILE-CN China Mobile Communications Grou 8151 12778 12185 UNINET, MX 12479 7230 7081 UNI2-AS, ES 7545 5988 5449 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5026 4949 ERX-CERNET-BKB China Education and Research Net 39891 4969 4897 ALJAWWALSTC-AS, SA 18403 4558 4534 FPT-AS-AP FPT Telecom Company, VN 9498 4844 4511 BBIL-AP BHARTI Airtel Ltd., IN 22773 4784 4412 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7552 4047 4018 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887 - C 396894 UNALLOCATED 8.28.201.0/24 3356 LEVEL3 - Level 3 Parent 13450 UNALLOCATED 8.29.117.0/24 55002 DEFENSE-NET - F5, Inc., 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE - Phonos 395195 UNALLOCATED 8.38.115.0/24 3356 LEVEL3 - Level 3 Parent 1782 UNALLOCATED 8.42.19.0/24 3356 LEVEL3 - Level 3 Parent 13342 UNALLOCATED 12.17.5.0/24 174 COGENT-174 - Cogent Com 26345 UNALLOCATED 12.21.93.0/24 40264 TWC-40264-WI-MN-UPPERMI 396831 UNALLOCATED 12.23.198.0/24 7018 ATT-INTERNET4 - AT&T En 397665 UNALLOCATED 12.24.28.0/24 7018 ATT-INTERNET4 - AT&T En Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE - Hurricane Electric LLC, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.48.0/24 Origin: 16904 ARVIG-16904 - Arvig Enterprises Inc., US 23.137.48.0/24 Transit: 3257 GTT-BACKBONE GTT, US 23.137.200.0/24 Origin: 16276 OVH, FR 23.137.200.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.140.216.0/24 Origin: 27176 DATAWAGON - DataWagon LLC, US 23.140.216.0/24 Transit: 20278 NEXEON - Nexeon Technologies, Inc., US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS - Charter Communicat 23.142.24.0/24 Origin: 62164 HEYMMAN-2, CA 23.142.24.0/24 Transit: 64236 UNREAL-SERVERS - UnReal Servers, LLC, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:40 /11:95 /12:299 /13:584 /14:1200 /15:2106 /16:13709 /17:8374 /18:13628 /19:25667 /20:46575 /21:52904 /22:114111 /23:107593 /24:652084 /25:689 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 6944 12778 UNINET, MX 12479 6164 7230 UNI2-AS, ES 39891 3655 4969 ALJAWWALSTC-AS, SA 11492 3501 4641 CABLEONE - CABLE ONE, INC., US 6327 3488 3708 SHAW - Shaw Communications, CA 22773 3049 4784 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc., US 7155 2820 3861 VIASAT-SP-BACKBONE - ViaSat,Inc., US 16509 2592 14449 AMAZON-02 - Amazon.com, Inc., US 30036 2316 2663 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communications Corp, US 10620 2233 3453 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2534 2:1599 3:1001 4:5 5:5104 6:194 7:6 8:1520 9:28 11:172 12:1198 13:649 14:2696 15:459 16:177 17:398 18:918 20:603 21:4 22:188 23:8192 24:2657 25:2 27:2752 29:19 31:3402 32:31 34:87 35:294 36:4634 37:4470 38:10073 39:1269 40:423 41:4549 42:2057 43:2952 44:441 45:19876 46:4899 47:404 48:86 49:2193 50:2078 51:600 52:1296 54:278 55:1102 56:11 57:318 58:2425 59:1432 60:1176 61:3113 62:3120 63:1759 64:6226 65:2122 66:6028 67:3255 68:1503 69:4238 70:1043 71:615 72:3109 74:2987 75:1499 76:595 77:2845 78:1914 79:1792 80:2344 81:2227 82:3993 83:1455 84:2048 85:3827 86:1103 87:2409 88:1354 89:4691 90:811 91:8417 92:2858 93:3006 94:4333 95:4598 96:1450 97:314 98:949 99:797 100:67 101:1343 102:4465 103:32406 104:5497 105:792 106:925 107:2846 108:1217 109:4232 110:2289 111:4156 112:3156 113:1984 114:2188 115:2230 116:2162 117:3433 118:2966 119:2105 120:2710 121:1558 122:2988 123:2326 124:1716 125:3003 126:125 128:1671 129:967 130:1590 131:2411 132:792 133:463 134:1650 135:568 136:1602 137:1421 138:3139 139:1627 140:1847 141:1583 142:2517 143:2130 144:1724 145:638 146:2208 147:2147 148:2793 149:3014 150:1331 151:2679 152:2288 153:954 154:9615 155:2301 156:4381 157:2250 158:1500 159:2768 160:3805 161:1954 162:4006 163:2388 164:2032 165:2618 166:1305 167:2251 168:3964 169:889 170:5521 171:1108 172:4578 173:3449 174:888 175:1347 176:3822 177:4846 178:4334 179:2299 180:3026 181:4447 182:3971 183:2834 184:2013 185:21753 186:5675 187:4910 188:4564 189:4519 190:9756 191:1558 192:11464 193:9595 194:7847 195:5719 196:3317 197:3249 198:6281 199:6111 200:8188 201:6376 202:10878 203:10550 204:4772 205:3789 206:4509 207:4034 208:4383 209:5441 210:5001 211:2779 212:5009 213:4091 214:1053 215:46 216:7251 217:3536 218:1736 219:589 220:2198 221:1313 222:1077 223:3340 End of report

1 0

RPKI's 2025 Year in Review
by Job Snijders 04 Mar '26

04 Mar '26

Dear all, Happy new year! Wanna know how RPKI evolved throughout 2025? Read on! :) In this memo I'll share some RPKI statistics, summarize highlights from the IETF Standards Development process, and reflect on emerging trends. Year to Year Growth of the distributed RPKI database =============================================================== A straight-forward method to compare 2024 and 2025 is to look at the absolute numbers. The below table was constructed using data collected by RPKIViews.org between January 1st, 2025 and December 31st, 2025 with the ARIN, AfriNIC, APNIC, LACNIC, and RIPE NCC Trust Anchors. EOY 2024 / EOY 2025 Snapshot differences: ----------------------------------------- 2024-12-31 2025-12-31 ( diff) Total validated cache size (KB): 767,245 923,058 (+ 20%) Total number of files (object count): 415,384 493,707 (+ 19%) Wall time validation run (seconds): 46 35 (- 23%) Wall time without outliner CA (seconds): 26 33 (+ 27%) Publication servers (FQDNs): 53 60 (+ 13%) Certification authorities: 44,935 49,721 (+ 11%) Route Origin Authorizations (ROAs): 280,692 344,209 (+ 23%) Uniq Validated ROA Payloads: 639,900 787,737 (+ 23%) Average ROAIPAddresses per ROA: 2.3 1.8 (- 22%) Unique origin ASNs in ROAs: 47,282 52,661 (+ 11%) IPv4 addresses covered: 2,726,513,768 2,783,187,105 (+ 2%) Uniq IPv4 addresses covered: 1,658,281,248 1,818,913,944 (+ 10%) IPv6 addresses covered: 17,392 * 10^30 18,684 * 10^30 (+ 7%) Uniq IPv6 addresses covered: 15,139 * 10^30 16,384 * 10^30 (+ 8%) Unique ASPA Customer ASIDs: 87 556 (+539%) The number of IP addresses covered by RPKI ROAs grew by 10%. This is similar to last year's report. However, ASPA object count absolutely skyrocketed in 2025! The "Uniq ASPA Customer ASIDs" field is a simple gauge counter for global ASPA deployment on the signer side. At the moment of writing, for about 0.5% of Autonomous Systems in the Internet global routing system an ASPA record is published. That's a very interesting development. The ability to publish ASPA objects became readily available [4] in the RIPE NCC region in 2025, and as of January 2026 also fully available through ARIN Online [5]. The "Wall time validation run (seconds)" metric is produced by revalidating the data contained in the two snapshots multiple times in a benchmark using the same modern multi-threaded RPKI cache implementation on the same 4 CPU core machine, without performing any network operations (i.e. offline validation mode). This metric relates to the hypothesis that as the RPKI grows (in size and number of objects), without also improving efficiency (information density), the overall processing time to validate the complete dataset will increase. This year's benchmark environment: Rpki-client 9.7, OpenSSL 3.5.4, Debian 13, on Intel Xeon. WITH EVERY RPKI CA, FIRST 2024 THEN 2025: $ hyperfine -w2 'rpki-client -p4 -P 1735689171 -n -d rpki-20241231T235251Z/data /tmp' Time (mean ± σ): 46.514 s ± 0.172 s [User: 173.345 s, System: 5.264 s] Range (min … max): 46.257 s … 46.756 s 10 runs $ hyperfine -w2 'rpki-client -p4 -P 1767225374 -n -d rpki-20251231T235614Z/data /tmp' Time (mean ± σ): 35.046 s ± 0.206 s [User: 125.092 s, System: 5.894 s] Range (min … max): 34.756 s … 35.444 s 10 runs FIRST 2024 THEN 2025, WITHOUT THE OUTLINER CA: 20241231T235251Z: Time (mean ± σ): 26.257 s ± 0.152 s [User: 92.878 s, System: 4.590 s] Range (min … max): 26.069 s … 26.485 s 10 runs 20251231T235614Z: Time (mean ± σ): 32.903 s ± 0.143 s [User: 117.059 s, System: 5.444 s] Range (min … max): 32.635 s … 33.127 s 10 runs This year the "wall time" metric _seemingly_ deflated... but, unfortunately, further sleuthing shows that the 2024 numbers were heavily skewed by the products issued by a specific large CA under ARIN, an outliner so to speak. In the 2024 snapshot that one CA had 50,125 Manifest entries and 15,944 CRL entries, while in the 2025 snapshot the same CA had 48,896 Manifest entries and only 33 CRL entries. The key observation here is that the impact of large CRLs becomes more pronounced with longer Manifests. In conclusion and discounting the products of that one outliner CA, overall processing time of the RPKI increased by 25%. [ Note: the wall time metric is not comparable between successive annual reports (for example, next year I might use a different computer, or use a different validator implementation) - but within the context of a single annual report the comparison between the snapshots is apples to apples! ] The "Average ROAIPAddresses per ROA" metric shows how many IP prefixes, on average, are contained within a single ROA object. The higher the number of ROAIPAddresses per ROA is, the higher computational efficiency likely is to be. "Efficiency" in this context is viewed as how many ROAIPAddress entries are packed together and signed with a single EE certificate. A higher number means more efficiency (and less RP bandwidth consumption) The RIPE NCC hosted CA system yields 6.6 prefixes per ROA, while the current ARIN and LACNIC approach result in only 1.1 and 1.3 prefixes per ROA, respectively (almost the worst possible case). APNIC and its community lead in efficiency with 8.2 per ROA. The impact that CA implementation choices have on the RPKI's scalability remains an area of concern: large CA operators (such as the RIRs) need to take special care when deciding on parameters such as ROAIPAddress packing and certificate validity periods, in order to curb uneconomical Manifest & CRL growth. Issuing RPKI objects aiming for high information density helps improve predictable delivery trajectories towards relying parties. Statistics on accumulating counters throughout the year: -------------------------------------------------------- The following statistics were produced using the RPKIViews 2024 Amalgamation [6] and RPKIViews 2025 Amalgamation [7] datasets. I believe these datasets to be a near complete collection of all signed RPKI data produced in those years. Almost every ROA! The objects in the Zenodo hosted archives can be inspected with "rpki-client -jf" (filemode). 2024 2025 Number of Rpkiviews snapshots produced: 64,923 90,523 (+ 39%) Newly discovered RPKI objects: 56,586,149 61,524,413 (+ 9%) Avg number of new objects per second: 1.79 1.98 (+ 10%) Median object size (bytes): 1,924 1,924 ( -) Mean object size (bytes): 2,193 2,531 (+ 15%) Cumulative size of all objects (KB): 121,211,067 152,094,584 (+ 25%) The above numbers can be used to better understand RPKI transport protocol efficiency. More on that next year! IETF SIDROPS - Working Group developments ========================================= Some fun updates from the IETF working group responsible for development and maintenance of the RPKI technology stack... *** SIDROPS ***. This RPKI-focused design & implementation group now operates with a new charter. The most significant change in modus operandi being that RFC publication now requires multiple implementations to exist and interoperate. Read the full charter here: https://datatracker.ietf.org/wg/sidrops/about/ ASPA - where we at? ------------------- Close to Working Group Last call! Depending our luck this might mean the specifications are published in late 2026. Word on the streets is that various commercial-off-the-shelf/hardware vendors are working on ASPA implementations, and a number of BGP open source projects already made ASPA verification implementations available to the wider public. Other (New) Work in SIDROPS --------------------------- 1/ A new scalable data synchronisation protocol called Erik Synchronisation is in the works. It is a HTTP-based protocol using Merkle trees, a content-addressable naming scheme, and concurrency control using monotonically increasing sequence numbers. https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-erik-protocol 2/ What MRT Tabledumps meant for researching BGP, is what CCR is intended to be for the RPKI. CCR (Canonical Cache Representation) is a new small and efficient binary file format to record validation outcomes and hash markers. https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ccr SIDROPS Finished work --------------------- One new clarification RFC was published: * RFC 9829 - Handling of Resource Public Key Infrastructure (RPKI) Certificate Revocation List (CRL) Number Extensions https://www.rfc-editor.org/rfc/rfc9829.html Small Point On Housekeeping: ============================ The RPKIViews archive data collection approach and structure were revised at the start of 2026. A number of rpkiviews gatherer nodes now use a Tar+Zstandard spooling system to store raw data and associated snapshots in Canonical Cache Representation format. The changes in how RPKIviews data is stored should have a positive effect, meaning more snapshots can be gathered per hour while at the same time consuming less disk storage space than previously. I'm curious to see what this increase in data resolution might show us next year! Final words =============================================================== The RPKI remains an important tool in the toolbox to identify & prevent routing incidents. Deployment of RPKI allows operators to improve network reliability by strengthening the security and integrity of their interconnection with the global Internet routing system. The system is working pretty good and will continue to serve us well if special care is taken to continually monitor and optimize the RPKI's data packing practises & delivery methods. Kinds regards, Job Snijders ps. Shout out to Lee Hetherington, Matsuzaki "maz" Yoshinobu, Niels Bakker, Jeroen Lauwers, Jeroen Massar, Digital Ocean, and Tom Scholl for their help to the RPKIViews.org project. References: RPKIViews - http://www.rpkiviews.org/ https://dango.attn.jp/rpkidata/2024/12/31/rpki-20241231T235251Z.tgz https://josephine.sobornost.net/rpkidata/2025/12/31/rpki-20251231T235614Z.t… Last year's report: https://blog.apnic.net/2025/01/28/rpkis-2024-year-in-review/ 2023 report: https://labs.ripe.net/author/job_snijders/rpki-2023-review-growth-governmen… [4]: https://labs.ripe.net/author/tim_bruijnzeels/aspa-in-the-rpki-dashboard-a-n… [5]: https://www.arin.net/announcements/20260120/ [6]: Snijders, J., "RPKIViews 2024 Amalgamation". Zenodo. https://doi.org/10.5281/zenodo.18328474 [7]: Snijders, J., "RPKIViews 2025 Amalgamation". Zenodo. https://doi.org/10.5281/zenodo.18332099

15 25

Information for ASPA creation
by Koen van Hove 03 Mar '26

03 Mar '26

Hello all! I am currently working on a better ASPA UI in Krill. The goal is to provide a bit more confidence when creating an ASPA record that what was entered is correct, and, more importantly, does not accidentally break things once networks start validating and rejecting routes based on ASPA records. The last iteration of that UI can be found here: https://github.com/NLnetLabs/krill-ui/pull/58 I believe ARIN supports creating ASPA records, but from what I could gather from screenshot I don't think they provide any "hints". I know the RIPE NCC does not (currently) do this because there are a lot of asterisks; this topic was also discussed during the last RIPE Routing WG in Romania (https://ripe91.ripe.net/programme/meeting-plan/sessions/30/transcript/) But just because ARIN and the RIPE NCC don't do it, doesn't mean I cannot give it a shot anyway :-) Currently I do two things: 1. Show the likely AS name when you enter an AS number, to prevent simple typos (8283 instead of 8382, etc.); 2. Show which AS numbers appear "to the left" in RIPE RIS (without making a claim that they are missing per se, just that they were observed) along with their names. Don't press the button and nothing happens. The button also only appears when you have typed something in the providers field to prevent just copy pasting whatever it shows as "to the left" in RIS (and consequentially forgetting your DDoS providers, or upstreams that RIS didn't see, etc.) But as I am not an operator (apart from AS211321), I want your input as well. What is the kind of information you would want (or not want) to see before clicking the "Create ASPA" button? Cordially, Koen van Hove PS: This does not affect the CLI and API for Krill at all, it's only the web interface.

2 1

not quite a core routing issue but I would appreciate any insight on IPTV and internet service
by Andrew Kirch 02 Mar '26

02 Mar '26

Hi, The other members of the Condo Board I serve on found out I'm an ISP and now I'm stuck trying to find fiber internet and a preferably carrier neutral IPTV service. The ask is 1 gigabit of business fiber and something with local channels in zip code 34228 (Longboat Key, FL). I'd be very interested to get feedback particularly on the IPTV service options available, and your experience with them. We have 27 units, and approximately 60 to 70 TVs in total. Andrew

3 2

AT&T Outage Contact
by Eric C. Miller 02 Mar '26

02 Mar '26

Hello, does anybody have a working outage escalation list? Our contacts aren't answering on the weekend and express ticketing isn't letting us create tickets. It seems that nobody staffs their call center numbers anymore either. Thank you! Eric

2 1