[sidr] A quick note from RPKI in the wild

[Alex Band <[e-mail]>]

The RIPE NCC launched a Resource Certification platform on 1.1.2011, where members can choose to set up a certificate listing their address blocks. They can run RPKI software themselves, or use a hosted platform in our web portal. So far 715 out of our ~7500 members have done this. Out of the top 100 largest LIRs in our region, 28 have a certificate set up. About half of the enabled members have the certificate solely to get validatable proof of holdership of the address space they hold (for now?), the rest use it for BGP origin validation. 

By the latter group, 416 Route Origin Authorization (ROA) objects have been created, covering the equivalent of 230,000 /24 prefixes and 8,600 /32 IPv6 prefixes. MaxLength in ROAs is sorely misunderstood, lots of education is needed there. Most leave the field blank, causing more specific announcements to be invalid.

Lately though, there lots of activity with regards to tooling and testbeds. EuroTransit have set up a testbed with Randy/Rob's tools, as well as the NCC's: 

http://rpki01.fra2.de.euro-transit.net/documentation.html

They also made two public RPKI capable Juniper routers available. You can log into them using telnet with these details:

IPs: 193.34.50.25 and 193.34.50.26
user: rpki
password: testbed

You can run commands such as "show validation database" , "show validation statistics", "show validation session", "show bgp neighbor", "show bgp summary" and lastly "show route protocol bgp validation-state", followed by the state (valid, invalid, unknown or unverified)

I'm curious to hear what you think.

Cheers,

Alex Band
RIPE NCC

P.S. Here you can grab a pre-release of the NCC Validation tool that they run there (requires *NIX w/ Java, rsync):
https://certification.ripe.net/content/public-repo/releases/net/ripe/rpki-validator/rpki-validator-app/1.0.14/rpki-validator-app-1.0.14-bin.zip