Summary

  • RIPEstat RIS listed 91 IPv4 prefixes originated by AS24940 at 00:00 UTC on 8 October; the rpki-client AS24940 view was generated at 02:35:34 UTC.
  • A cross-match found an admitting same-origin VRP for 63 routes. For 49 of those route prefixes, at least one matching maximum length exceeded the route observed by RIS. This counts routes, not unique ROA objects.
  • Routinator still returns invalid_length for test /24s under the three narrowed prefixes and valid for a test 78.46.0.0/24 under 78.46.0.0/15; neither result proves an active /24 announcement, traffic, or universal ROV filtering.

The route is the audit unit

The route and VRP snapshots are separate observations, 2 hours 35 minutes apart. The rpki-client page lists 73 IPv4 VRP prefix entries for AS24940; 53 permit a more-specific than the listed prefix, including 52 that allow /24 and one /24 entry that allows /32. Comparing prefix coverage, origin, and maximum length yields 63 routes with a same-origin VRP that admits the route; 49 of those have a maximum length broader than the route RIS observed. The 49 are route prefixes, not unique ROA objects.

The other 28 had no length-permitting AS24940 match in this cross-snapshot comparison; without aligned per-prefix validation they cannot be labeled unknown, invalid_asn, or invalid_length. Madory’s September count of 50 uses a different, earlier measure, so the difference shows neither an increase nor a decrease.

A route-validation lookup on 8 October produces two different answers for Hetzner Online's AS24940. A test 162.55.80.0/24 is invalid_length under the current 162.55.0.0/16 ROA, whose maximum length is /16. A test 78.46.0.0/24 is still valid under 78.46.0.0/15, whose maximum length remains /24. RIPEstat's network-info endpoint currently maps an address in that second range to the /15 route originated by AS24940.

The contrast matters because the first prefix was part of the August BGP hijack against Softaculous, the company behind the Virtualizor update service. In a 22 September guest post on the APNIC Blog, Internet analyst Doug Madory reported that Hetzner had narrowed the affected 162.55.0.0/16 authorization to /16. He also reported that two other ROAs—213.133.96.0/19 and 213.239.192.0/18—had been tightened from /24 to their covering prefix lengths.

The current Routinator tests agree with those three changes. A hypothetical /24 under each prefix now returns invalid_length: maximum lengths are /16, /19, and /18. These are validation tests, not claims that those /24s were announced. They show what the current ROAs would say about a matching announcement with AS24940 as its origin.

That limit is central to the security reading. RPKI origin validation checks whether an announced prefix and origin ASN fit a published Route Origin Authorization. It does not verify every hop in the AS path or establish that the route is benign. A broad maximum length can allow a more-specific route to pass the origin check when the path presents the authorized origin; a result of valid is therefore a scoped statement about the ROA, not a trust label for the route.

The update is still meaningful. Narrowing a ROA for the affected block changes what an ROV validator will accept for that block. But fixing three prefixes does not show that every active route has a matching, least-permissive authorization. The useful unit of follow-up is the complete set of routed prefixes and ROAs, with exceptions and timestamps recorded—not the number of visibly repaired objects alone.

Sources