Summary

  • At RIPE 93, Sam van Kampen presented RISwhois-rs as a drop-in successor to the routing lookup service first released in 2003.
  • The service now ingests observations hourly and can append RPKI origin-validation results with -R; collector visibility and authorization remain separate kinds of evidence.

The Internet has kept a little port-43 phonebook since 2003. Ask RISwhois about a prefix and it tells you what RIPE's route collectors saw. The phonebook now has a new engine. It can also check the caller's origin paperwork, provided you ask for that extra page.

At RIPE 93 on 26 October, RIPE NCC developer Sam van Kampen introduced RISwhois-rs. His original slides describe the classic implementation as roughly 4,000 lines of C90 with a forking server, no multithreading and no test suite. That is the speaker's account of the inherited machine, not a fresh code audit. Its successor is designed to fit the same doorway: a drop-in replacement with multithreaded ingest, a tokio server, tests and built-in metrics. Van Kampen calls it RIPE NCC's first production Rust service.

The operational change is visible in the answer's clock. The slides say data ingest is now hourly. They also introduce experimental Parquet dumps. RIPE's service documentation says text dumps are generated on request, rather than on the former daily schedule. Those are different clocks: hourly intake does not promise a freshly generated text dump every hour.

What does a normal lookup establish? Fields such as seen-at name the RIS collectors that observed a route; num-rispeers reports peer visibility. They describe a view from a collection network. Adding -R asks a second question. The response can include rpki-ov-state and covering rpki-vrp records, comparing the observed prefix and origin against Route Origin Authorizations. RIPE's origin-validation guide explains the prefix, origin ASN and maximum-length test. An operator then chooses what routing policy to apply.

Put those fields together and an investigator gets a useful compact answer: who saw this announcement, and how does its origin compare with published authorization? The two columns should keep their labels. A collector's sighting is evidence of observation; valid, invalid or unknown is the result of a separate VRP comparison. One port and one screen can make them look like one verdict. They are two.

The slides float more frequent ingest and RIS Live as future possibilities. For now, the real story is an old public interface with a new implementation and clearer ways to ask about origin authorization. The phonebook survived its engine swap. Its best feature remains knowing which page you are reading.

Original sources