مدقق مسارات RPKI

The Resource Public Key Infrastructure lets the holder of an IP block publish a signed Route Origin Authorisation (ROA): a statement that a given AS may originate the block, up to a maximum prefix length. Networks that perform route origin validation use these to reject routes that contradict them.

Route origin validation (RFC 6811) has three outcomes. A route is valid when a ROA covers the prefix, names its origin AS and allows its length. It is invalid when ROAs cover the prefix but none matches: either a different AS originates it, or it is more specific than the max length allows. It is not found when no ROA covers it, so RPKI says nothing about it.

We validate against our own copy of the validated ROA payloads, built from the five RIRs’ trust anchors by the rpki-client project and refreshed every few hours. Leave the AS field empty to validate the origin our BGP table currently sees.