Summary

  • Quinzi, Pelsser and Di Battista estimate that updates associated with RPKI events remain below 1% of daily BGP updates observed at RIPE RIS RRC00, including peaks; the share is rising from a low base.
  • The figure is deliberately conservative and comes from one collector. It is evidence about that measurement vantage, not proof of a universal Internet-wide share or of zero effect on any individual network.

The denominator matters

A paper published in June in Proceedings of the ACM on Networking asks how much BGP update activity can be associated with changes to RPKI data. An updated Route Origin Authorization can change a route’s validation state. A router’s policy may then alter its decision and send a BGP update—but a changed ROA does not automatically produce one. The authors call the measured traffic “RPKI-related” because temporal association cannot establish the cause of every individual update.

Their denominator is not every update generated by every router. It is the daily update volume received by RIPE RIS RRC00, the oldest RIPE Routing Information Service collector, selected to provide the longest history. The paper reports 114 collector peers at the time of writing, 80 with full routing tables, and 349 distinct peers over the study period. Those peers span five continents, giving the series breadth. They do not turn a single collector into a census; the authors explicitly note that other collectors may see a different level of noise.

A deliberately wide attribution window

To make eleven years of data tractable, the researchers examined Mondays from January 2014 through August 2025. Monday had the largest observed distribution of ROA changes and was chosen to push the estimate upward. For each event cluster affecting a prefix, they counted every BGP update in a convergence window. Their experiments found convergence within three hours, and they chose a conservative threshold. Some updates in that window may have come from unrelated routing events. Counting them all makes the estimate an upper bound rather than a causal tally.

The long view reconstructs events from RIPE’s daily RPKI Archive snapshots. A snapshot is not an event log: missing ROAs can hide real changes or make overlapping records look like false changes. The researchers checked the reconstruction against RPKI-Flutter, which has five independent validators fetching objects every 30 seconds from May 2024 onward. The two sources produce similar update-volume levels in their overlap through August 2025, although Archive-derived event counts can be higher. The sources measure different things, so this comparison improves confidence without erasing the reconstruction limits.

Small is not static

At RRC00, the estimated share remained below 1% of daily updates, including event peaks. In the Flutter series it rose from 0.069% for IPv4 and 0.024% for IPv6 in May 2024 to 0.116% and 0.033%, respectively, in August 2025. The paper describes an approximately twofold increase over that period. The absolute share was still small; the upward direction remains a reason to keep measuring.

This distinction matters for operational judgment. The study provides evidence against treating RPKI event volume as a major source of BGP noise at this vantage today. It does not establish the load on a particular router, the behavior of a different peer set, route quality, reachability, or packet delivery. RFC 9324 separately recommends that RPKI-policy speakers avoid asking neighbors for a route refresh just because new RPKI data arrived; that mechanism limits one form of control-plane burden, but it does not make route changes disappear.

Heng Lu’s “Running-Code Primacy” offers the editorial test, not evidence for this result: judge infrastructure claims against observable operation. RRC00 gives a long and unusually broad operating view. Its boundary is part of the finding.

Sources: Quinzi, Pelsser and Di Battista, paper and open PDF; Quinzi’s APNIC account; RFC 9324; RFC 6811.