On Wed, Mar 30, 2022 at 01:29:25PM +0000, Drew Weaver wrote:
Ex 45.176.191.0/24 3356 3549 11172 270150
RPKI ROA entry for 45.176.191.0/24-24 Origin-AS: 265621
Two questions:
First, are you also seeing this on this specific route?
It is visible in a few places, but the 61% score in for example RIPE stat is very low, which is a strong hint some kind of issue exists: https://stat.ripe.net/ui2013/45.176.191.0%2F24#tabId=routing
Second, is there a certain number of "expected" invalid routes? (not including unknowns)
Through large transit providers that do RPKI ROV with 'invalid == reject' you'll generally see less than a 100 invalids at any given time (1299, 174, 3257, 3303, 6830, etc). Then there are large transit providers who (as far as the public record is concerned) have not yet deployed RPKI ROV on their EBGP edges. Via AS 6762 I see ~ 2,300 invalids, and via AS 6461 about 3,000 invalids. For historical perspective: this 3,000 upperbound number used to be ~ 6,000 back in the 'pre RPKI era' in 2018/2019.
Third, how are you handling specifically the large number of routes from 3356 3549 which invalid origin AS? Are you just "letting the bodies hit the floor"? or are you carving those out somehow?
I'd reject them. Why carve out an exception merely because the number is 'large'? :-) Kind regards, Job