Summary

  • In RIPE 93 measurements, multi-homed networks reached 50% vantage-point recovery in a median 9 minutes after a route changed from Invalid to Valid; single-homed networks took 12 minutes.
  • When a route changed from Valid to Invalid, the order flipped: 50% reachability took 42 minutes for multi-homed networks and 30 minutes for single-homed networks.

Two upstreams can make the same route come back sooner and disappear later. That is not a paradox. It is what happens when each upstream updates its view of a changed Route Origin Authorization on its own schedule.

The result came from a talk at RIPE 93 on measuring RPKI status changes in the data plane. The work followed roughly 25,000 changes in the RIPE repository that changed validated payloads, then isolated about 1,500 single-transition events suitable for measuring a change from reachable to unreachable or back. The presenters sent traceroutes from more than 300 CAIDA Ark nodes after a detected change and followed each event for an hour.

Their clock did not measure the moment a ROA was edited or the instant a validator fetched it. It measured when 50% of the participating vantage points could again reach a prefix, or could no longer reach it, after the RPKI state changed. Those are different clocks, and an operator who mixes them will confuse a database update with a network outcome.

The way back is faster with another upstream

When a route changed from RPKI Invalid to Valid, multi-homed networks reached the study's 50% vantage-point mark in a median nine minutes. Single-homed networks took 12 minutes. An extra upstream gave the route another chance to benefit from a validator that had fetched and processed the updated information sooner.

The advantage is modest in the median, but the distribution also had a thinner slow tail for multi-homed networks. The presenters' mechanism is plain: each upstream runs its own relying-party software and refresh cycle. Two independent refresh paths give a network more chances to learn that the route is authorized.

The route did not become Valid because it had two upstreams. A ROA specifies an origin authorization; the local validator calculates a state from the published objects. The measured difference appears after that state changes, while separate upstreams and routers absorb the update.

The way out takes longer

Now reverse the transition. When a previously Valid route became Invalid, the median time for 50% of vantage points to lose reachability was 30 minutes for single-homed networks and 42 minutes for multi-homed networks.

The spare path is still doing its job. If one upstream has refreshed its RPKI view and changes its route treatment while another has not, the second can keep announcing the route to part of the Internet. The more independent paths a network has, the more opportunities there are for one path to remain visible during the transition.

That distinction matters in an incident. A route's new Invalid state is not a global stop command. Networks decide how their local policy treats Invalid announcements, and their validators do not fetch new data in unison. BGP then chooses among the routes still being announced. A control-plane status can change before the data plane stops carrying traffic.

The session measured the transition in single-origin cases and excluded cases with a covering announcement, so the measured path was not simply replaced by a less-specific route. Traceroutes ran for one hour. The sample covered single-origin cases and ended each traceroute run after one hour; its reported medians describe that observed window.

One label, several clocks

RPKI validation is often discussed as though publication, validation and forwarding happen in one breath. In practice, the chain has separate timers: a resource holder changes a ROA; a repository publishes it; relying-party software retrieves and validates it; routers receive updated state; local policy changes route treatment; and the data plane settles.

The RIPE 93 work got an early signal by monitoring the origin side of the RIPE repository and using an optimized validator. The presenter said that signal arrived at least 57 seconds before the public validators in the comparison and five minutes earlier at the median. That head start let the researchers start traceroutes before much of the network reacted. It was a measurement technique, not a claim that RIPE NCC controls every validator's refresh schedule.

The result gives operators a useful distinction: the time to learn that a ROA changed and the time until a route stops being reachable are not the same service level. If a customer asks whether a correction has taken effect, a portal timestamp cannot answer for every upstream. If a security team expects invalidation to stop an ongoing hijack, the measured 30-to-42-minute median leaves a long interval in which some vantage points still saw reachability.

Sources: RIPE 93 session abstract and recording; official RIPE 93 plenary transcript; RFC 6811, BGP Prefix Origin Validation.