I am trying to understand RPKI better and I am looking at some raw data dumps. My initial understanding of RPKI was that it would help identify and authenticate "the one" ASN that is authorized to announce a specific prefix. But looking at raw data from https://console.rpki-client.org/, I can see that there the are often multiple ASNs that have an authorization to announce a prefix (via a valid ROA).

Example: https://rpki.cloudflare.com/?view=validator&validateRoute=57578_45.131.68.0%2F22

At first I thought these might be different ASNs of the same business entity, but that does not seem to be case the for the examples where I checked this.

I would like to understand what is the background of this or the underlying logic behind this? And is there any further structure to this, as in, is any of the ASNs preferred in any way if two different ASNs announce the same prefix? Looking at the data the only differentiation that might make sense is the duration of the validity of the records, maybe the one with the longest validity is preferred if one would need to decide between two ASNs?

Thanks a lot!

New contributor
fjahr is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.


Your Answer

fjahr is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.