From kuwauters at gmail.com  Tue Dec  4 19:43:57 2018
From: kuwauters at gmail.com (Kurt Wauters)
Date: Tue, 4 Dec 2018 20:43:57 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
Message-ID: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>

Hi guys,

I was trying to check if routinator is fetching all ROA from the RIRs prior
to feeding it to my routers but i've got the impression that he's only
fetching RIPE data and none of the others.

I've currently left the installation to it's defaults settings and tals are
present in .rpki-cache/tals. For ARIN i've followed the procedure to update
the tal and i'm using following command ./routinator -o test.json -f json.

I've checked the "repository" directories under the non-ripe folders and
they contain *.cer files so i guess their fetching

Any idea what i'm doing wrong or where i should start looking?

thanks
Kurt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181204/381cb5e2/attachment.htm>

From job at ntt.net  Tue Dec  4 19:49:44 2018
From: job at ntt.net (Job Snijders)
Date: Tue, 4 Dec 2018 20:49:44 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
Message-ID: <20181204194944.GE49673@hanna.meerval.net>

Hi Kurt,

On Tue, Dec 04, 2018 at 08:43:57PM +0100, Kurt Wauters wrote:
> I was trying to check if routinator is fetching all ROA from the RIRs prior
> to feeding it to my routers but i've got the impression that he's only
> fetching RIPE data and none of the others.
> 
> I've currently left the installation to it's defaults settings and tals are
> present in .rpki-cache/tals. For ARIN i've followed the procedure to update
> the tal and i'm using following command ./routinator -o test.json -f json.
> 
> I've checked the "repository" directories under the non-ripe folders and
> they contain *.cer files so i guess their fetching
> 
> Any idea what i'm doing wrong or where i should start looking?

What does "grep 199.43.0.0/24 test.json" show?

Can you run routinator like this, and share the output?

    ./routinator -o test.json -f json -v

What version of routinator are you using?

Kind regards,

Job


From kuwauters at gmail.com  Tue Dec  4 20:15:29 2018
From: kuwauters at gmail.com (Kurt Wauters)
Date: Tue, 4 Dec 2018 21:15:29 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <20181204194944.GE49673@hanna.meerval.net>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
Message-ID: <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>

 Hi Job,

This is the output when running in verbose and I'm able to find then
mentioned prefix which seems to be ARIN. I was looking for prefixes of
AS9381 (RIR - APNIC) which seem to be missing, I'm still running 0.1

Kind regards
Kurt




*[kurt at localhost bin]# grep 199.43.0.0/24 <http://199.43.0.0/24> test.json
    { "asn": "AS10745", "prefix": "199.43.0.0/24 <http://199.43.0.0/24>",
"maxLength": 24 },[kurt at localhost bin]#*












*[kurt at localhost bin]# ./routinator -o test.json -f json -vThe RIPE NCC
Certification Repository is subject to Terms and ConditionsSee
http://www.ripe.net/lir-services/ncc/legal/certification/repository-tc
<http://www.ripe.net/lir-services/ncc/legal/certification/repository-tc>The
RIPE NCC Certification Repository is subject to Terms and ConditionsSee
http://www.ripe.net/lir-services/ncc/legal/certification/repository-tc
<http://www.ripe.net/lir-services/ncc/legal/certification/repository-tc>skipping
unknown file rsync://ca.rg.net/rpki/RGnet/kk7leA2QyWB46-RxM5KVfKhI7nk.gbr
<http://ca.rg.net/rpki/RGnet/kk7leA2QyWB46-RxM5KVfKhI7nk.gbr>[kurt at localhost
bin]# ./routinator -VRoutinator
0.1
[kurt at localhost bin]#   *

On Tue, Dec 4, 2018 at 8:49 PM Job Snijders <job at ntt.net> wrote:

> Hi Kurt,
>
> On Tue, Dec 04, 2018 at 08:43:57PM +0100, Kurt Wauters wrote:
> > I was trying to check if routinator is fetching all ROA from the RIRs
> prior
> > to feeding it to my routers but i've got the impression that he's only
> > fetching RIPE data and none of the others.
> >
> > I've currently left the installation to it's defaults settings and tals
> are
> > present in .rpki-cache/tals. For ARIN i've followed the procedure to
> update
> > the tal and i'm using following command ./routinator -o test.json -f
> json.
> >
> > I've checked the "repository" directories under the non-ripe folders and
> > they contain *.cer files so i guess their fetching
> >
> > Any idea what i'm doing wrong or where i should start looking?
>
> What does "grep 199.43.0.0/24 test.json" show?
>
> Can you run routinator like this, and share the output?
>
>     ./routinator -o test.json -f json -v
>
> What version of routinator are you using?
>
> Kind regards,
>
> Job
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181204/71f318d4/attachment.htm>

From job at ntt.net  Tue Dec  4 20:22:36 2018
From: job at ntt.net (Job Snijders)
Date: Tue, 4 Dec 2018 21:22:36 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
Message-ID: <20181204202236.GG49673@hanna.meerval.net>

On Tue, Dec 04, 2018 at 09:15:29PM +0100, Kurt Wauters wrote:
> This is the output when running in verbose and I'm able to find then
> mentioned prefix which seems to be ARIN. I was looking for prefixes of
> AS9381 (RIR - APNIC) which seem to be missing, I'm still running 0.1

At this stage I'd recommend to either use the latest release, or use the
master branch.

    latest code in the master branch: cargo install --force --git https://github.com/NLnetLabs/routinator.git
    latest release: cargo install --force routinator

Be sure to use rust 1.30

> *[kurt at localhost bin]# grep 199.43.0.0/24 <http://199.43.0.0/24> test.json
>     { "asn": "AS10745", "prefix": "199.43.0.0/24 <http://199.43.0.0/24>",
> "maxLength": 24 },[kurt at localhost bin]#*

The fact that that blob of JSON shows up is proof that this routinator
instance is fetching ARIN data as well.

What made you think you are only seeing RIPE data? Can you point at
specific ROAs or VRPs you are missing?

Kind regards,

Job


From kuwauters at gmail.com  Tue Dec  4 20:39:23 2018
From: kuwauters at gmail.com (Kurt Wauters)
Date: Tue, 4 Dec 2018 21:39:23 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <20181204202236.GG49673@hanna.meerval.net>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
 <20181204202236.GG49673@hanna.meerval.net>
Message-ID: <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>

Thanks Job,

I've upgrade routinator but i still can't find anything back from AS9381.
I'm expecting to see for example 43.251.20.0/22 but it's simply missing,
there is actually nothing from then ASN or the networks behind.
I'm just discovering the world of ROA's so it's probably a mismatch in
expectations then.






*./cargo --version --verbosecargo 1.30.0 (a1a4ad372 2018-11-02)release:
1.30.0commit-hash: a1a4ad37271b61209cd55d21f2c83f2773cbe113commit-date:
2018-11-02*



On Tue, Dec 4, 2018 at 9:22 PM Job Snijders <job at ntt.net> wrote:

> On Tue, Dec 04, 2018 at 09:15:29PM +0100, Kurt Wauters wrote:
> > This is the output when running in verbose and I'm able to find then
> > mentioned prefix which seems to be ARIN. I was looking for prefixes of
> > AS9381 (RIR - APNIC) which seem to be missing, I'm still running 0.1
>
> At this stage I'd recommend to either use the latest release, or use the
> master branch.
>
>     latest code in the master branch: cargo install --force --git
> https://github.com/NLnetLabs/routinator.git
>     latest release: cargo install --force routinator
>
> Be sure to use rust 1.30
>
> > *[kurt at localhost bin]# grep 199.43.0.0/24 <http://199.43.0.0/24>
> test.json
> >     { "asn": "AS10745", "prefix": "199.43.0.0/24 <http://199.43.0.0/24
> >",
> > "maxLength": 24 },[kurt at localhost bin]#*
>
> The fact that that blob of JSON shows up is proof that this routinator
> instance is fetching ARIN data as well.
>
> What made you think you are only seeing RIPE data? Can you point at
> specific ROAs or VRPs you are missing?
>
> Kind regards,
>
> Job
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181204/f2ef9a74/attachment.htm>

From job at instituut.net  Tue Dec  4 20:51:26 2018
From: job at instituut.net (Job Snijders)
Date: Tue, 4 Dec 2018 20:51:26 +0000
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
 <20181204202236.GG49673@hanna.meerval.net>
 <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
Message-ID: <20181204205126.GA92055@vurt.meerval.net>

Dear Kurt,

On Tue, Dec 04, 2018 at 09:39:23PM +0100, Kurt Wauters wrote:
> I've upgrade routinator but i still can't find anything back from
> AS9381.  I'm expecting to see for example 43.251.20.0/22 but it's
> simply missing, there is actually nothing from then ASN or the
> networks behind.

Are you perhaps confusing "IRR route objects" and "RPKI ROAs"?

I do see IRR route objects related to that prefix and ASN, but I don't
see RPKI ROAs: http://irrexplorer.nlnog.net/search/43.251.20.0/22

irrexplorer does not use routinator, but the RIPE NCC RPKI Cache
Validator, so this is not a routinator-specific issue.

> I'm just discovering the world of ROA's so it's probably a mismatch in
> expectations then.

Welcome! If you are new to this it can be helpful to take at the RPKI
FAQ. Please let us know how this reads to you and if you found it
helpful or not:

    https://nlnetlabs.nl/projects/rpki/faq/

But, perhaps the RPKI FAQ should be extended to include a "What is the
difference between an IRR route object and a RPKI ROA?"

Kind regards,

Job


From kuwauters at gmail.com  Tue Dec  4 20:54:07 2018
From: kuwauters at gmail.com (Kurt Wauters)
Date: Tue, 4 Dec 2018 21:54:07 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <20181204205126.GA92055@vurt.meerval.net>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
 <20181204202236.GG49673@hanna.meerval.net>
 <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
 <20181204205126.GA92055@vurt.meerval.net>
Message-ID: <CAN5iXRWT-96mbHSEbUBUDA+xVqyWuD3wws9obbPHvZTO-fF_Qg@mail.gmail.com>

 Thanks! that might explain it, I didn't know where else i could check it
and i probably made the rookie mistake of mixing it with the IRRs
So it means that i need to plan a talk with them and try to convince them
that it's a good idea to use ROA :)

Thanks for the help guys
Kurt

On Tue, Dec 4, 2018 at 9:51 PM Job Snijders <job at instituut.net> wrote:

> Dear Kurt,
>
> On Tue, Dec 04, 2018 at 09:39:23PM +0100, Kurt Wauters wrote:
> > I've upgrade routinator but i still can't find anything back from
> > AS9381.  I'm expecting to see for example 43.251.20.0/22 but it's
> > simply missing, there is actually nothing from then ASN or the
> > networks behind.
>
> Are you perhaps confusing "IRR route objects" and "RPKI ROAs"?
>
> I do see IRR route objects related to that prefix and ASN, but I don't
> see RPKI ROAs: http://irrexplorer.nlnog.net/search/43.251.20.0/22
>
> irrexplorer does not use routinator, but the RIPE NCC RPKI Cache
> Validator, so this is not a routinator-specific issue.
>
> > I'm just discovering the world of ROA's so it's probably a mismatch in
> > expectations then.
>
> Welcome! If you are new to this it can be helpful to take at the RPKI
> FAQ. Please let us know how this reads to you and if you found it
> helpful or not:
>
>     https://nlnetlabs.nl/projects/rpki/faq/
>
> But, perhaps the RPKI FAQ should be extended to include a "What is the
> difference between an IRR route object and a RPKI ROA?"
>
> Kind regards,
>
> Job
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181204/0af1443d/attachment.htm>

From teun at bit.nl  Tue Dec  4 20:45:50 2018
From: teun at bit.nl (Teun Vink)
Date: Tue, 4 Dec 2018 21:45:50 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
 <20181204202236.GG49673@hanna.meerval.net>
 <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
Message-ID: <04838BCA-26CA-4A9E-A786-FE23EEB2903B@bit.nl>


> On 4 Dec 2018, at 21:39, Kurt Wauters <kuwauters at gmail.com> wrote:
> 
> Thanks Job, 
> 
> I've upgrade routinator but i still can't find anything back from AS9381. I'm expecting to see for example 43.251.20.0/22 but it's simply missing, there is actually nothing from then ASN or the networks behind. 
> I'm just discovering the world of ROA's so it's probably a mismatch in expectations then.
[...]

I don't see any ROA for that prefix on my validator, neither does BGPmon:

$ whois -h whois.bgpmon.net  43.251.20.0/22 | grep ^RPKI
RPKI status:         No ROA found

I don't think any prefix within AS9381 has a ROA, and HE seems to agree: https://bgp.he.net/AS9381#_prefixes (no red/green key icons there).

Regards,
-- 
Teun Vink
BIT           | teun at bit.nl     | +31 318 648 688
KvK: 09090351 | GPG: 0xFC8B25D6 | RIPE: TEUN-RIPE

From job at ntt.net  Tue Dec  4 20:55:49 2018
From: job at ntt.net (Job Snijders)
Date: Tue, 4 Dec 2018 21:55:49 +0100
Subject: [RPKI] wRe:  ROA export seems to fetch only RIPE data
Message-ID: <20181204205549.GA1079@hanna.meerval.net>

Dear Kurt,

On Tue, Dec 04, 2018 at 09:39:23PM +0100, Kurt Wauters wrote:
> I've upgrade routinator but i still can't find anything back from
> AS9381.  I'm expecting to see for example 43.251.20.0/22 but it's
> simply missing, there is actually nothing from then ASN or the
> networks behind.

Are you perhaps confusing "IRR route objects" and "RPKI ROAs"?

I do see IRR route objects related to that prefix and ASN, but I don't
see RPKI ROAs: http://irrexplorer.nlnog.net/search/43.251.20.0/22

irrexplorer does not use routinator, but the RIPE NCC RPKI Cache
Validator, so this is not a routinator-specific issue.

> I'm just discovering the world of ROA's so it's probably a mismatch in
> expectations then.

Welcome! If you are new to this it can be helpful to take at the RPKI
FAQ. Please let us know how this reads to you and if you found it
helpful or not:

    https://nlnetlabs.nl/projects/rpki/faq/

But, perhaps the RPKI FAQ should be extended to include a "What is the
difference between an IRR route object and a RPKI ROA?"

Kind regards,

Job


From kuwauters at gmail.com  Tue Dec  4 21:06:01 2018
From: kuwauters at gmail.com (Kurt Wauters)
Date: Tue, 4 Dec 2018 22:06:01 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <CACWOCC-ZgAg-MRUfMX-Tj88ky8Y2A9g5Rk3ZZj8Yzb7vvKHN7g@mail.gmail.com>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
 <20181204202236.GG49673@hanna.meerval.net>
 <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
 <20181204205126.GA92055@vurt.meerval.net>
 <CAN5iXRWT-96mbHSEbUBUDA+xVqyWuD3wws9obbPHvZTO-fF_Qg@mail.gmail.com>
 <CACWOCC-ZgAg-MRUfMX-Tj88ky8Y2A9g5Rk3ZZj8Yzb7vvKHN7g@mail.gmail.com>
Message-ID: <CAN5iXRUJTqo9XK4tkmm-U1zUiUpXB2cXvXD=JAqtTV=NtwkKNg@mail.gmail.com>

Thanks Job,

i'll have a look at the docs and try to get them convinced

Kurt

On Tue, Dec 4, 2018 at 10:00 PM Job Snijders <job at ntt.net> wrote:

> Hi Kurt,
>
> On Tue, Dec 4, 2018 at 9:54 PM Kurt Wauters <kuwauters at gmail.com> wrote:
> > Thanks! that might explain it, I didn't know where else i could check it
> and i probably made the rookie mistake of mixing it with the IRRs
> > So it means that i need to plan a talk with them and try to convince
> them that it's a good idea to use ROA :)
>
> The ASN and IP prefix you mentioned are both managed by APNIC - APNIC
> has excellent resources on how to create RPKI ROAs
>
> https://training.apnic.net/courses/esec04-introduction-to-rpki/
> https://www.apnic.net/get-ip/faqs/rpki/
> https://www.apnic.net/community/security/resource-certification/
>
> Additionally - the APNIC staff can help via email or phone.
>
> Kind regards,
>
> Job
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181204/e57df4c4/attachment.htm>

From job at ntt.net  Tue Dec  4 21:00:27 2018
From: job at ntt.net (Job Snijders)
Date: Tue, 4 Dec 2018 22:00:27 +0100
Subject: [RPKI] ROA export seems to fetch only RIPE data
In-Reply-To: <CAN5iXRWT-96mbHSEbUBUDA+xVqyWuD3wws9obbPHvZTO-fF_Qg@mail.gmail.com>
References: <CAN5iXRWT26qTFESGBp28Y4MPDFFo6d4LArFd98ew_7P44xM65w@mail.gmail.com>
 <20181204194944.GE49673@hanna.meerval.net>
 <CAN5iXRWU-_WFKXjpaWowKw+RA27L7MZdGEAJY=-2Mc7O9ZdMbw@mail.gmail.com>
 <20181204202236.GG49673@hanna.meerval.net>
 <CAN5iXRU+HeYcrgza9ooGHPQfzsP+PHLyq2-L+rVjnUAUXwFyNw@mail.gmail.com>
 <20181204205126.GA92055@vurt.meerval.net>
 <CAN5iXRWT-96mbHSEbUBUDA+xVqyWuD3wws9obbPHvZTO-fF_Qg@mail.gmail.com>
Message-ID: <CACWOCC-ZgAg-MRUfMX-Tj88ky8Y2A9g5Rk3ZZj8Yzb7vvKHN7g@mail.gmail.com>

Hi Kurt,

On Tue, Dec 4, 2018 at 9:54 PM Kurt Wauters <kuwauters at gmail.com> wrote:
> Thanks! that might explain it, I didn't know where else i could check it and i probably made the rookie mistake of mixing it with the IRRs
> So it means that i need to plan a talk with them and try to convince them that it's a good idea to use ROA :)

The ASN and IP prefix you mentioned are both managed by APNIC - APNIC
has excellent resources on how to create RPKI ROAs

https://training.apnic.net/courses/esec04-introduction-to-rpki/
https://www.apnic.net/get-ip/faqs/rpki/
https://www.apnic.net/community/security/resource-certification/

Additionally - the APNIC staff can help via email or phone.

Kind regards,

Job


From martin at nlnetlabs.nl  Wed Dec 12 15:46:40 2018
From: martin at nlnetlabs.nl (Martin Hoffmann)
Date: Wed, 12 Dec 2018 16:46:40 +0100
Subject: [RPKI] Routinator 0.2.0 released
Message-ID: <20181212164640.40ce0294@glaurung.nlnetlabs.nl>

Dear RPKI Mailing List,

Routinator version 0.2.0 ?Instant Gezellig? has been released!

This release both cleans up the initial release and prepares for new
features to come. Most importantly, we decided to change command line
handling and switched to the ever popular model of requesting actions
via sub-commands. You can now request a list of the validated ROA
payload (aka VRP) via the `vrps` command and start the RTR server via
`rtrd`.

Instead of repeating options over and over again, you can now put them
into a config file. You can either explicitly pick a file via the
`-c` option or keep `.routinator.conf` in your home directory. The
config file can contain all global options and the additional options
for the RTR server. It is a TOML file. A complete example is available
in the source repository[0].

Another change is that we adjusted the output formats for the `vrps`
command to be even closer to those used by the RIPE NCC Validator by
adding trust anchor information. On top of that, Job Snijders
contributed a new output that makes it easier to use Routinator with
OpenBGPD.

Finally, deployment is now ever so much easier thanks to the Dockerfile
contributed by David Monosov. If you are using Docker, you can now get
Routinator from the Docker Hub simply by::

   docker pull nlnetlabs/routinator

If you have Routinator installed from cargo.io, you can upgrade to the
latest release via::

   cargo install --force routinator

You can read about all the changes in this release in the complete
Changelog in the source repository[1]. More information about
Routinator itself can be found in the NLnetLabs/routinator Github
repository[2] and in routinators man page.

On his way to the whisky globe,
Martin

---
[0] https://github.com/NLnetLabs/routinator/blob/master/etc/routinator.toml 
[1] https://github.com/NLnetLabs/routinator/blob/master/Changelog.md 
[2] https://github.com/NLnetLabs/routinator


From rpki at braeburn.org  Thu Dec 13 02:56:43 2018
From: rpki at braeburn.org (Jay Borkenhagen)
Date: Wed, 12 Dec 2018 21:56:43 -0500
Subject: [RPKI] recent increase in invalid routes: Starhub
Message-ID: <23569.51819.213817.496645@oz.mt.att.com>

Hi,

Earlier Wednesday, Markus Weber from KPN and I compared notes on
another mailing list regarding a recent step increase in invalid
routes seen by our networks.  Job Snijders thought it would be good to
mention it to this list, too, so here it is:

Between two snapshots taken 24 hours apart, I noticed an increase of
more than 1100 invalid prefixes (ipv4+ipv6) as received in
as7018.  On 11-Dec I had counted about 5300, and on 12-Dec it was
up to almost 6500. 

A time-series plot shows increases occurring just after 1200 UTC on
11-Dec, and again after 0900 UTC on 12-Dec.  (Of course this timing
depends on the schedule I have my RPs running and other factors.)

I noticed that many of the new invalids were ipv4 /23s and /24s
originated by as55430 (Starhub in Singapore) under a VRP of
222.164.0.0/16-22;as55430, and ipv6 /48s also originated by as55430
under a VRP of 2406:3003::/32-38;as55430.

Markus had a more complete data set, and he saw the following
increases in invalids originating in the following Starhub ASNs: 

     15 srcAS=28118
     30 srcAS=9874
    283 srcAS=55430
    429 srcAS=4657

Does anyone here know folks at Starhub who can be educated, or see
anything else in the data worth discussing here?

Thanks.

						Jay B.

PS: My apologies if this message comes through twice.



From rpki at braeburn.org  Thu Dec 13 02:50:20 2018
From: rpki at braeburn.org (Jay Borkenhagen)
Date: Wed, 12 Dec 2018 21:50:20 -0500
Subject: [RPKI] recent increase in invalid routes
Message-ID: <23569.51436.872740.339512@oz.mt.att.com>

Hi,

Earlier Wednesday, Markus Weber from KPN and I compared notes on
another mailing list regarding a recent step increase in invalid
routes seen by our networks.  Job Snijders thought it would be good to
mention it to this list, too, so here it is:

Between two snapshots taken 24 hours apart, I noticed an increase of
more than 1100 invalid prefixes (ipv4+ipv6) as received in
as7018.  On 11-Dec I had counted about 5300, and on 12-Dec it was
up to almost 6500. 

A time-series plot shows increases occurring just after 1200 UTC on
11-Dec, and again after 0900 UTC on 12-Dec.  (Of course this timing
depends on the schedule I have my RPs running and other factors.)

I noticed that many of the new invalids were ipv4 /23s and /24s
originated by as55430 (Starhub in Singapore) under a VRP of
222.164.0.0/16-22;as55430, and ipv6 /48s also originated by as55430
under a VRP of 2406:3003::/32-38;as55430.

Markus had a more complete data set, and he saw the following
increases in invalids originating in the following Starhub ASNs: 

     15 srcAS=28118
     30 srcAS=9874
    283 srcAS=55430
    429 srcAS=4657

Does anyone here know folks at Starhub who can be educated, or see
anything else in the data worth discussing here?

Thanks.

						Jay B.



From nusenu-lists at riseup.net  Thu Dec 13 20:48:00 2018
From: nusenu-lists at riseup.net (nusenu)
Date: Thu, 13 Dec 2018 20:48:00 +0000
Subject: [RPKI] recent increase in invalid routes: Starhub
In-Reply-To: <23569.51819.213817.496645@oz.mt.att.com>
References: <23569.51819.213817.496645@oz.mt.att.com>
Message-ID: <06008136-21bd-81e4-7504-863b1dcaa973@riseup.net>

I don't measure all invalid announcements - I just measure
unreachable IP space so my numbers are significantly lower
than yours (<2k vs. >5k prefixes) and can not be compared directly.

I use exclusively RIPE RIS dumps and publish my resulting data here:
https://nusenu.github.io/RPKI-Observatory

I can confirm an increase in unreachable IPv6 prefixes on 2018-12-12 but I'm primarily
measuring IP space by size (not by prefix count) and
by that metric I didn't see a relevant event (with a measurement probing resolution of 12h
on 2018-12-12 compared to other events when unreachable IP space changed.

According to the data I see, a single ROA for AS55430 that became effective
on 2018-12-12 10:32:10 UTC caused most of the
new unreachable prefixes.
The specific ROA contains a maxlen of /38 (typo?)
and invalidated 182 IPv6 prefixes, but since
all of them are just /48s it didn't affect to much IPv6 space
when compared with the overall numbers.

Datetime		#IPv6 prefixes		/48s
+---------------------+----------+--------------------+
| 2018-11-23 02:35:00 |      103 |            1742227 |
| 2018-11-29 14:35:00 |      140 |            2069913 |
| 2018-12-07 14:35:00 |      124 |            2532249 |
| 2018-12-10 02:35:00 |      125 |            2532250 |
| 2018-12-10 14:35:00 |      125 |            2532250 |
| 2018-12-11 02:35:00 |      125 |            2532250 |
| 2018-12-11 14:35:00 |      125 |            2532250 |
| 2018-12-12 02:35:00 |      123 |            1942426 |
| 2018-12-12 14:35:00 |      294 |            1942604 |
+---------------------+----------+--------------------+

The IPv4 numbers didn't change much on that day:

+---------------------+----------+--------------------+
| 2018-11-23 02:35:00 |     1623 |               8889 |
| 2018-11-29 14:35:00 |     1673 |               8961 |
| 2018-12-07 14:35:00 |     1620 |              10125 |
| 2018-12-10 02:35:00 |     1582 |               9068 |
| 2018-12-10 14:35:00 |     1577 |               9063 |
| 2018-12-11 02:35:00 |     1580 |               9064 |
| 2018-12-11 14:35:00 |     1614 |               9127 |
| 2018-12-12 02:35:00 |     1619 |               9132 |
| 2018-12-12 14:35:00 |     1610 |               9123 |
+---------------------+----------+--------------------+

If you would like to reduce the number of unreachable
IPv6 space effectively there are many (22) ASNs which
announce more unreachable IPv6 address space than AS55430.
https://nusenu.github.io/RPKI-Observatory/unreachable_as-v6.html

-- 
https://twitter.com/nusenu_
https://mastodon.social/@nusenu

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181213/800d3032/attachment.bin>

From christoffer at netravnen.de  Fri Dec 21 20:13:05 2018
From: christoffer at netravnen.de (Christoffer Hansen)
Date: Fri, 21 Dec 2018 21:13:05 +0100
Subject: [RPKI] Routinator deplyment
Message-ID: <7405cc6a-d5f0-694b-fa08-d14fcc901c21@netravnen.de>

Failing routinator install on v6 only machine.

Sigh...

GitHub and IPv6...

```
[2018-12-21T20:08:00Z] netravnen @ atkins > ~
$ cargo install routinator
    Updating crates.io index
warning: spurious network error (2 tries remaining): curl error:
; class=Net (12)
warning: spurious network error (1 tries remaining): curl error:
; class=Net (12)
error: failed to fetch `https://github.com/rust-lang/crates.io-index`


Caused by:
  curl error:
; class=Net (12)
```

When are they getting there...(?)

-- 
Christoffer Hansen
0x18DD23C550293098DE07052A9DCF2CA008EBD2E8

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: OpenPGP digital signature
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181221/f6960715/attachment.bin>

From christoffer at netravnen.de  Sat Dec 29 00:25:16 2018
From: christoffer at netravnen.de (Christoffer Hansen)
Date: Sat, 29 Dec 2018 01:25:16 +0100
Subject: [RPKI] Suggestion for Watchdog method to always ensure routinator
 is running
Message-ID: <8dc95238-cd5b-2f3c-a721-d0cc8c7afa18@netravnen.de>

To rpki@,

Do any subscriber to this list have any good idea's for ensuring
Routinator is always started after a reboot or when the daemon for
$_reasons crashed?

Thinking of currently using crontab or $_script to start routinator at
boot. But really wanting some kind of watchdog solution to always ensure
routinator is running.

@NLnetLabs: Would be nice if you could document|recommend|suggest a
method together with the current instructions to get routinator up and
running for the above described case. ;)

-- 
Cheers

Christoffer
0x18DD23C550293098DE07052A9DCF2CA008EBD2E8

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: OpenPGP digital signature
URL: <http://lists.nlnetlabs.nl/pipermail/rpki/attachments/20181229/c440d861/attachment.bin>