Martin Levy and the 14-day clock for ghost routes

Martin Levy Put a 14-Day Clock on Ghost Routes

Why it matters

A route record can outlive the intention that put it there. Martin Levy and two fellow policy authors gave the RIPE database a wonderfully unromantic answer: send a warning, start the clock, and let the holder's signed authorisation settle the argument.

Sofia Ren24 October 2026Reading Time 2 minLast update: 24 October 2026

Martin Levy and the fourteen-day clock. AI editorial illustration grounded in his named APNIC 27 speaker photograph; the operations room is imagined.

Summary

Martin Levy, Job Snijders and Erik Bais developed RIPE proposal 2018-06 to remove non-authoritative route objects that conflict with a resource holder's RPKI authorisation.
The final rule gives a conflicting object fourteen consecutive days, with attempts to notify the relevant contacts. The first production run flagged 978 objects and emailed 269 addresses.

When the old address book talks back

An Internet Routing Registry entry may say that one autonomous system intends to announce a prefix. Operators can turn such entries into filters. In RIPE-NONAUTH, however, an entry concerning resources managed outside RIPE's region could sit there without the holder ever consenting to it. Its afterlife became a problem once a holder published a cryptographically backed Route Origin Authorisation, or ROA, naming a different origin.

RIPE's proposal record names Martin Levy alongside Job Snijders and Erik Bais. Their answer was pleasantly specific. Compare the prefix and origin ASN in a non-authoritative route or route6 object with the holder's ROA. If origin validation calls the object invalid, notify the contacts available through its RPSL fields and, where possible, find the holder through RDAP. The final RIPE-731 policy then waits for fourteen consecutive days of conflict before deleting the object and sending final notice.

Those fourteen days are the interesting bit. Immediate deletion would put too much faith in a single snapshot of two systems. Endless tolerance would leave a misleading instruction available to whoever builds routing filters from the registry. The clock gives errors a chance to be corrected and persistent contradictions a definite end. RIPE-managed resources sit outside this particular procedure; the authors aimed at RIPE-NONAUTH's weaker authority.

The policy was accepted in November 2019 and implemented in January 2020. When the nightly cleanup first ran, RIPE NCC reported 978 conflicting route objects marked for cleanup and emails sent to 269 addresses. Those numbers show the queue and its notice trail as the clock began. Levy's APNIC speaker record places him in a career spent building operational networks. Here he helped make a database's old claim yield, on a predictable schedule, to the resource holder's newer signed one.