RIPE’s ASPA Dashboard: Three Numbers, Three Denominators

RIPE’s ASPA Dashboard Has Three Numbers and One Uncomfortable Question

Why it matters

Five percent of registered ASNs have ASPA objects, while 12.5% of examined paths get partial coverage. RIPE’s own invalid-path line asks what the dashboard should actually tell an operator.

Theo March3 November 2026Reading Time 2 minLast update: 3 November 2026

RIPE NCC reported distinct ASPA adoption, partial path coverage and apparent invalid-path rates at RIPE 93.

Summary

RIPE NCC says about 5% of registered ASNs in its region have an ASPA object; its path analysis finds roughly 12.5% partial coverage.
Among paths with any ASPA, roughly 8–9% appear invalid. An operator challenged the measurement assumption during the same session.

A green adoption chart is a poor substitute for a route decision. At RIPE 93, RIPE NCC engineer Tim Bruijnzeels offered three figures that belong on different pieces of paper: about 5% of registered ASNs in the service region have an ASPA object; roughly 12.5% of the paths he examined had partial ASPA coverage; and 8–9% of paths with any ASPA appeared invalid. The last figure has a narrower denominator than all paths.

His method started with RIS observations and Routinator validation data. For each unique shortest path, he followed the announcement toward the first network whose ASPA declares AS0, treating the preceding legs as customer-to-provider. Partial coverage meant at least one other AS on the path had a valid ASPA statement. One signed AS can therefore light up a path even when most of its legs remain unknown.

The red line is where the comfortable chart becomes an argument. An apparent invalid could be a forgotten provider, a route leak, path spoofing or a fault in the method. Gert Döring told the session that researchers had flagged ASes in his own ASPA as missing providers; several were cloud or DDoS services, and he disputed the premise. Bruijnzeels invited operators with route-server or transit data to test his result. RIPE has published no case-level classification or path counts for this 8–9% line.

The RIPE 93 transcript supplies the methods, figures and exchange. The talk abstract separately estimates that up to 9% of provider ASNs are omitted from ASPA objects. That is a provider-ASN estimate, not the invalid-path rate. Recycling one percentage as the other would turn a denominator error into a security headline.