I am trying to understand RPKI better and I am looking at some raw data dumps. My initial understanding of RPKI was that it would help identify and authenticate "the one" ASN that is authorized to announce a specific prefix. But looking at raw data from https://console.rpki-client.org/, I can see that there the are often multiple ASNs that have an authorization to announce a prefix (via a valid ROA).

Example: https://rpki.cloudflare.com/?view=validator&validateRoute=57578_45.131.68.0%2F22

At first I thought these might be different ASNs of the same business entity, but that does not seem to be case the for the examples where I checked this.

I would like to understand what is the background of this or the underlying logic behind this? And is there any further structure to this, as in, is any of the ASNs preferred in any way if two different ASNs announce the same prefix? Looking at the data the only differentiation that might make sense is the duration of the validity of the records, maybe the one with the longest validity is preferred if one would need to decide between two ASNs?

Thanks a lot!

3 Answers 3


The obvious answer is: because the BGP specification allows it. There is no requirement that a single ASN advertises a specific prefix, your assumption that there can be only one ASN originating a prefix is wrong.

There are a number of common use cases for creating ROAs for originating prefixes from different ASNs:

  1. BGP any cast allows a prefix to be announced by multiple ASNs at the same time. The best path will win. This is for example done with many of the root DNS servers.
  2. When transferring prefixes from one network to another, you don’t want to haven to deal with updates and cache timeouts for ROAs, so you make sure the ROAs for the new ASN are present before it starts announcing the prefix, so the transition is as smooth as possible, without having to disable RPKI.
  3. Some anti DDoS solutions work by advertising the prefix under attack from their ASN, drawing traffic to their scrubbing center. To do this, you need to have valid ROAs for the scrubbing center’s ASN as well as for the network advertising the prefix in peace time.

Anycast can be a valid use case requiring origination of the same prefix from multiple ASNs. ROAs would then provide protection against hijacking by listing the valid ASNs which can originate a given prefix.


It looks like Cloudflare tool is malfunctionning (not displaying some valid ROA I know, and displaying what you linked). You can use the RIPE tool instead.

An ROA is supposed to be unique.

  • Thanks for your response but in RIPE tool I also see multiple matches for the prefix: rpki-validator.ripe.net/ui/…. In the dump from console.rpki-client.org I can find about 30000 of such records that match another prefix in the dump just with another ASN. I mean, the ROAs are unique when taking prefix and ASN together but it seems having multiple ROAs for the same prefix is ok, otherwise I don't know how to explain this.
    – fjahr
    Jul 3, 2022 at 22:20
  • A ROA is defined by the tuple (prefix, ASN, min length), that combination should be unique, there can be many different variations on combinations of there three values.
    – Teun Vink
    Jul 28, 2022 at 4:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.