#rpki — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #rpki, aggregated by home.social.
-
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Without a ROA, your prefix announced from someone else's network looks exactly like your prefix announced from yours. A router has nothing to check it against.
A ROA names which network is allowed to originate your prefix. Anyone else announcing it is then RPKI invalid, and networks filtering on validation drop them. That is the whole reason to sign.
With isp6 it's a button on the dashboard: type your origin AS, press Add, and we publish the ROA to RIPE.
-
Without a ROA, your prefix announced from someone else's network looks exactly like your prefix announced from yours. A router has nothing to check it against.
A ROA names which network is allowed to originate your prefix. Anyone else announcing it is then RPKI invalid, and networks filtering on validation drop them. That is the whole reason to sign.
With isp6 it's a button on the dashboard: type your origin AS, press Add, and we publish the ROA to RIPE.
-
Without a ROA, your prefix announced from someone else's network looks exactly like your prefix announced from yours. A router has nothing to check it against.
A ROA names which network is allowed to originate your prefix. Anyone else announcing it is then RPKI invalid, and networks filtering on validation drop them. That is the whole reason to sign.
With isp6 it's a button on the dashboard: type your origin AS, press Add, and we publish the ROA to RIPE.
-
Approximately 3.5% of ASNs seen making #BGP announcements have created RPKI #ASPA objects.
This is a decent ramp up before the spec is even out of draft and the big iron from commercial router vendors have production code deployed for validating these (ASPA) paths from the #RPKI.
https://social.bgp.tools/@newaspa/statuses/01M11SXFGP5536WH52SQ0PEECF
-
Approximately 3.5% of ASNs seen making #BGP announcements have created RPKI #ASPA objects.
This is a decent ramp up before the spec is even out of draft and the big iron from commercial router vendors have production code deployed for validating these (ASPA) paths from the #RPKI.
https://social.bgp.tools/@newaspa/statuses/01M11SXFGP5536WH52SQ0PEECF
-
Approximately 3.5% of ASNs seen making #BGP announcements have created RPKI #ASPA objects.
This is a decent ramp up before the spec is even out of draft and the big iron from commercial router vendors have production code deployed for validating these (ASPA) paths from the #RPKI.
https://social.bgp.tools/@newaspa/statuses/01M11SXFGP5536WH52SQ0PEECF
-
Approximately 3.5% of ASNs seen making #BGP announcements have created RPKI #ASPA objects.
This is a decent ramp up before the spec is even out of draft and the big iron from commercial router vendors have production code deployed for validating these (ASPA) paths from the #RPKI.
https://social.bgp.tools/@newaspa/statuses/01M11SXFGP5536WH52SQ0PEECF
-
Approximately 3.5% of ASNs seen making #BGP announcements have created RPKI #ASPA objects.
This is a decent ramp up before the spec is even out of draft and the big iron from commercial router vendors have production code deployed for validating these (ASPA) paths from the #RPKI.
https://social.bgp.tools/@newaspa/statuses/01M11SXFGP5536WH52SQ0PEECF
-
rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking -
rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking -
rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking -
rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking -
rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking -
For future reference:
/usr/bin/sh -c 'awk -v RS="" "/protocol static {\n\s+aspa/,/^}/" < /etc/bird-rpki/bird > /etc/bird-rpki/birdfilt'
-
For future reference:
/usr/bin/sh -c 'awk -v RS="" "/protocol static {\n\s+aspa/,/^}/" < /etc/bird-rpki/bird > /etc/bird-rpki/birdfilt'
-
For future reference:
/usr/bin/sh -c 'awk -v RS="" "/protocol static {\n\s+aspa/,/^}/" < /etc/bird-rpki/bird > /etc/bird-rpki/birdfilt'
-
For future reference:
/usr/bin/sh -c 'awk -v RS="" "/protocol static {\n\s+aspa/,/^}/" < /etc/bird-rpki/bird > /etc/bird-rpki/birdfilt'
-
Can I get ASPA validation (with Debian stable packages?)
fort-validator 1.6.6 does not seem to have it (only 1.7.0-experimental?)
stayrtr 0.6.4 apparently doesn't either.
What now? -
Can I get ASPA validation (with Debian stable packages?)
fort-validator 1.6.6 does not seem to have it (only 1.7.0-experimental?)
stayrtr 0.6.4 apparently doesn't either.
What now? -
Can I get ASPA validation (with Debian stable packages?)
fort-validator 1.6.6 does not seem to have it (only 1.7.0-experimental?)
stayrtr 0.6.4 apparently doesn't either.
What now? -
Can I get ASPA validation (with Debian stable packages?)
fort-validator 1.6.6 does not seem to have it (only 1.7.0-experimental?)
stayrtr 0.6.4 apparently doesn't either.
What now? -
BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.
-
BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.
-
BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.
-
BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.
-
BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.
-
Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.
Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt
-
Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.
Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt
-
Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.
Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt
-
Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.
Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt
-
Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.
Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt
-
New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/ -
New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/ -
New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/ -
New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/ -
New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/ -
bgpipe v0.22 is out! 🚀
New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.
Which means every stage you already use just works on them:
bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'
That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.
-
bgpipe v0.22 is out! 🚀
New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.
Which means every stage you already use just works on them:
bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'
That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.
-
bgpipe v0.22 is out! 🚀
New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.
Which means every stage you already use just works on them:
bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'
That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.
-
bgpipe v0.22 is out! 🚀
New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.
Which means every stage you already use just works on them:
bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'
That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.
-
bgpipe v0.22 is out! 🚀
New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.
Which means every stage you already use just works on them:
bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'
That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.
-
Weekend Reads
* Inside an Internet shutdown
https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
* Inferring shared IP addresses
https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
* BGP origin attribute manipulation
https://blog.cloudflare.com/bgp-origin-attribute/
* IP reassembly congestion DoS attacks
https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
* Operators on academic BGP security solutions
https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content -
Weekend Reads
* Inside an Internet shutdown
https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
* Inferring shared IP addresses
https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
* BGP origin attribute manipulation
https://blog.cloudflare.com/bgp-origin-attribute/
* IP reassembly congestion DoS attacks
https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
* Operators on academic BGP security solutions
https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content -
Weekend Reads
* Inside an Internet shutdown
https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
* Inferring shared IP addresses
https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
* BGP origin attribute manipulation
https://blog.cloudflare.com/bgp-origin-attribute/
* IP reassembly congestion DoS attacks
https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
* Operators on academic BGP security solutions
https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content -
Weekend Reads
* Inside an Internet shutdown
https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
* Inferring shared IP addresses
https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
* BGP origin attribute manipulation
https://blog.cloudflare.com/bgp-origin-attribute/
* IP reassembly congestion DoS attacks
https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
* Operators on academic BGP security solutions
https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content
