Re: A few questions regarding about RPKI/invalids

[Job Snijders via NANOG <nanog () nanog org>]

On Wed, Mar 30, 2022 at 01:29:25PM +0000, Drew Weaver wrote:
> Ex 45.176.191.0/24   3356 3549 11172 270150
>
> RPKI ROA entry for 45.176.191.0/24-24
>   Origin-AS: 265621
>
> Two questions:
>
> First, are you also seeing this on this specific route?

It is visible in a few places, but the 61% score in for example RIPE
stat is very low, which is a strong hint some kind of issue exists:
https://stat.ripe.net/ui2013/45.176.191.0%2F24#tabId=routing

> Second, is there a certain number of "expected" invalid routes? (not
> including unknowns)

Through large transit providers that do RPKI ROV with 'invalid ==
reject' you'll generally see less than a 100 invalids at any given time
(1299, 174, 3257, 3303, 6830, etc).

Then there are large transit providers who (as far as the public record
is concerned) have not yet deployed RPKI ROV on their EBGP edges. Via AS
6762 I see ~ 2,300 invalids, and via AS 6461 about 3,000 invalids.

For historical perspective: this 3,000 upperbound number used to be ~
6,000 back in the 'pre RPKI era' in 2018/2019.

> Third, how are you handling specifically the large number of routes
> from 3356 3549 which invalid origin AS? Are you just "letting the
> bodies hit the floor"? or are you carving those out somehow?

I'd reject them. Why carve out an exception merely because the
number is 'large'? :-)

Kind regards,

Job