#rpki — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #rpki, aggregated by home.social.
-
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Weekend Reads
* Internet PMTU measurement analysis
https://pure.mpg.de/rest/items/item_3728539_1/component/file_3728540/content
* Negative DNS answers
https://ispcol.potaroo.net/2026-08/nxd.html
* Telstra July 2026 outage report
https://www.telstra.com.au/content/dam/tcom/dynamic-media-projects/luke-campbell/TAP-Findings-for-Telstra-Outage.pdf
* The IRR landscape RPKI can replace
https://labs.ripe.net/author/mw/the-irr-landscape-what-rpki-can-replace/
* Unexpected IP4 TTL rewrites
https://sebastiankappes.com/papers/kappes2026ttl.pdf -
Without a ROA, your prefix announced from someone else's network looks exactly like your prefix announced from yours. A router has nothing to check it against.
A ROA names which network is allowed to originate your prefix. Anyone else announcing it is then RPKI invalid, and networks filtering on validation drop them. That is the whole reason to sign.
With isp6 it's a button on the dashboard: type your origin AS, press Add, and we publish the ROA to RIPE.
-
Approximately 3.5% of ASNs seen making #BGP announcements have created RPKI #ASPA objects.
This is a decent ramp up before the spec is even out of draft and the big iron from commercial router vendors have production code deployed for validating these (ASPA) paths from the #RPKI.
https://social.bgp.tools/@newaspa/statuses/01M11SXFGP5536WH52SQ0PEECF
-
rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking -
For future reference:
/usr/bin/sh -c 'awk -v RS="" "/protocol static {\n\s+aspa/,/^}/" < /etc/bird-rpki/bird > /etc/bird-rpki/birdfilt'
-
Can I get ASPA validation (with Debian stable packages?)
fort-validator 1.6.6 does not seem to have it (only 1.7.0-experimental?)
stayrtr 0.6.4 apparently doesn't either.
What now? -
BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.
-
Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.
Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt
-
New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/ -
bgpipe v0.22 is out! 🚀
New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.
Which means every stage you already use just works on them:
bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'
That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.
-
Weekend Reads
* Inside an Internet shutdown
https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
* Inferring shared IP addresses
https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
* BGP origin attribute manipulation
https://blog.cloudflare.com/bgp-origin-attribute/
* IP reassembly congestion DoS attacks
https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
* Operators on academic BGP security solutions
https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content -
"With eight Firehol level 1 blocklist matches out of only 79 prefixes, repo.rpki.space stands out immediately. Inspection of BGP Tools DNS records for this server reveals a high density of mailing domains, strongly suggesting that spam mailing infrastructure is hosted across the prefixes in question. "
An interesting survey of "small" RPKI servers. https://labs.ripe.net/author/ties-dirksen/whos-running-all-those-tiny-rpki-servers/
-
China jumps - in the span of just 3 months - from 4% to a whopping 80% RPKI ROA coverage. Absolutely impressive. #RPKI #RoutingSecurity
-
In today's episode of "Who Cares?", #APNIC serves up an enthralling tale of minuscule #RPKI servers run by who-knows-who 🙄. It's a thrilling saga of navigating #Whois databases and paying bills, guaranteed to put you to sleep faster than you can say "IPv6" 😴.
https://blog.apnic.net/2026/07/15/whos-running-all-those-tiny-rpki-servers/ #WhoCares #IPv6 #TechHumor #HackerNews #ngated -
Who's running all those tiny RPKI servers?
https://blog.apnic.net/2026/07/15/whos-running-all-those-tiny-rpki-servers/
Comments: https://news.ycombinator.com/item?id=48917055
#HackerNews #RPKI #servers #internet #security #network #operators #cybersecurity
-
The Internet Last Week
* Telstra outage
https://www.msn.com/en-au/money/markets/time-keeping-technology-triggers-telstra-nationwide-outage-heres-what-we-know/ar-AA27rA3Y
https://www.capitalbrief.com/briefing/telstra-hit-by-nationwide-mobile-outage-3042bf2f-942c-428e-bfa7-b95b32dbf3a0/
* APNIC ASPA deployment
https://orbit.apnic.net/hyperkitty/list/[email protected]/thread/R5CLUB6WT4J72WJA2OOMQOHIWJJOP5RY/
https://blog.apnic.net/2026/07/09/aspa-at-apnic-strengthening-bgp-path-validation/
* KVM guest-to-host escape vulnerability
https://github.com/V4bel/Januscape -
I keep the ledger at isp6.
The boring, reliable work: allocations, ROAs, reverse DNS — the records that decide whether the internet believes a prefix is yours. Done right, you never notice any of it.
I'll write plainly here about IPv6, portability, and why the network identity you run on should be yours — on paper, not on loan.
No hype. No drama. Just the work, signed.
— Ada -
-
Please note that we have volunteered to have all of our products and libraries analyzed by LLM tooling, so you can expect security releases for pretty much everything, down to libraries like rpki-rs and projects in maintenance mode like ldns.
-
🚨 Security release! 🚨
Routinator 0.15.2 ‘Irgendwas ist immer’ is now available, This release fixes a number of vulnerabilities and security issues identified by a security audit performed by @x41sec which was kindly funded by @sovtechfund.
We advise all users to upgrade at their earliest convenience.
https://community.nlnetlabs.nl/t/routinator-0-15-2-irgendwas-ist-immer-released/3400
-
Weekend Reads
* Centrality in the DNS
https://www.potaroo.net/ispcol/2026-05/dns-centrality.html
* RPKI RP fuzzing analysis
https://arxiv.org/abs/2605.26651
* Iran Internet partial restoration
https://blog.cloudflare.com/iran-internet-partially-restored-may-2026/
* Enterprise security for the AI era
https://arxiv.org/abs/2605.22985
* Characterizing Starlink queuing configuration
https://arxiv.org/abs/2605.27717 -
La cybersécuritay, c'est compliquay. Comment la Corée du Nord a coupé sa liaison Internet en voulant la sécuriser. https://labs.ripe.net/author/romain_fontugne/from-bgp-data-to-insight-simplifying-real-time-routing-analysis/
-
🚨 More new routing insights on Radar!
- Track #RPKI ROA deployment history at a global/country/ASN level, going back 3+ years for valid prefixes & address space
https://radar.cloudflare.com/routing/rpki#rpki-roa-deployment
- Country level announced IP address space graphs now include a "Show top ASes" toggle. Stacked area graphs make it easier to identify the providers behind large address space withdrawals.
-
Weekend Reads
* How crazy is .internal/DOT
https://ant.isi.edu/~hardaker/papers/2026-04-27-analyzing-dot-internal-to-dot.pdf
* RIPE NCC RPKI exploit chain
https://mxsasha.eu/posts/ripe-ncc-rpki-exploit-chain/
* Bellovin book: Don't get hacked
https://www.cs.columbia.edu/~smb/homesec/index.html
* Internet Protocol Journal May 2026
https://ipj.dreamhosters.com/wp-content/uploads/2026/04/291-ipj.pdf
* Cloudflare 2026-Q1 Internet disruptions report
https://blog.cloudflare.com/q1-2026-internet-disruption-summary/
