Summary

  • Antonio Prado’s July 2026 analysis shows that a single IPv6 /29 contains 524,288 distinct /48s, against a global IPv6 BGP table he put at about 219,000 entries at the time.
  • Route Origin Authorisations identify an allowed origin AS. Prefix volume is controlled at the neighbour boundary by filters and maximum-prefix settings.

The arithmetic is rude. Antonio Prado took one IPv6 /29, divided it into /48s, and got 524,288 possible announcements. In his RIPE Labs account of a collaborative routing-security survey, the whole global IPv6 BGP table stood at roughly 219,000 entries when he wrote in July 2026. A single allocation contains more potential route entries than that dated table twice over. The thought experiment has no villain or packet capture attached; it has a multiplication problem for anyone who accepts routes.

Prado’s team mapped BGP attacks into four broad categories and eight narrower ones. Origin hijacking gets the familiar tools. Four other classes—state volatility, prefix deaggregation, policy manipulation and attribute-driven session resets—have no cryptographic validation answer in that map. A router still has practical defences. It needs an operator to configure them and decide which peer may send how much.

That makes the /29 example sharper than a generic warning about too many routes. A RIPE NCC explanation of origin validation says a ROA states which autonomous system may originate an IP prefix. It does not allocate memory for half a million more-specific announcements or set a safe threshold on a peering. One database answer can be correct while the receiving router faces a very different question: how many entries from this neighbour are acceptable?

RFC 7454 gives the unglamorous answer: filter routes at the boundary and configure a maximum number of prefixes per peer. A customer should send the prefixes it is entitled to send; an upstream carrying a full table needs a different limit. The document also demands headroom and regular review. Make the limit too high and a flood gets room to grow. Make it too low and ordinary network growth can shut the session. Neither choice can be made by a green ROA badge.

Prado’s own biography places him between research and the room where operators exchange practice: a routing-security researcher and RIPE Programme Committee member. His survey, with Flavio Luciani and six other named contributors, asks the uncomfortable operational question after the cryptographic success story. The party that sets the neighbour limit bears the immediate decision; the route recipient and its customers bear the consequences of a bad one.

A dated announcement trace, the receiving peers’ prefix limits and their route-state changes would turn Prado’s arithmetic into a specific incident account. For now, it is a very large possible route count set beside a dated table estimate—and a precise explanation of why origin authority is only one field in a router’s risk ledger.