[RPKI] recent increase in invalid routes

Jay Borkenhagen rpki at braeburn.org
Thu Dec 13 02:50:20 UTC 2018


Earlier Wednesday, Markus Weber from KPN and I compared notes on
another mailing list regarding a recent step increase in invalid
routes seen by our networks.  Job Snijders thought it would be good to
mention it to this list, too, so here it is:

Between two snapshots taken 24 hours apart, I noticed an increase of
more than 1100 invalid prefixes (ipv4+ipv6) as received in
as7018.  On 11-Dec I had counted about 5300, and on 12-Dec it was
up to almost 6500. 

A time-series plot shows increases occurring just after 1200 UTC on
11-Dec, and again after 0900 UTC on 12-Dec.  (Of course this timing
depends on the schedule I have my RPs running and other factors.)

I noticed that many of the new invalids were ipv4 /23s and /24s
originated by as55430 (Starhub in Singapore) under a VRP of;as55430, and ipv6 /48s also originated by as55430
under a VRP of 2406:3003::/32-38;as55430.

Markus had a more complete data set, and he saw the following
increases in invalids originating in the following Starhub ASNs: 

     15 srcAS=28118
     30 srcAS=9874
    283 srcAS=55430
    429 srcAS=4657

Does anyone here know folks at Starhub who can be educated, or see
anything else in the data worth discussing here?


						Jay B.

More information about the RPKI mailing list