Summary

  • At RIPE 93, Meta described three separate controls after a routing incident: ID Communities to identify a prefix, a Route Registry to permit it at a boundary, and continuous control-plane monitoring to catch mismatches.
  • Meta says it remedied nearly all violations found in production within months. Its public talk abstract gives no starting count; the next useful evidence is a dated boundary-by-boundary before-and-after record.

A route with a name tag can still walk through the wrong door. That is the operator problem behind Daria Shantalova's RIPE 93 account. Meta says an earlier routing incident revealed gaps at the boundaries among its backbone domains. It built three checks rather than asking one BGP label to play passport, visa and border guard at once.

First comes identity. Meta's ID Communities attach a unique tag to each prefix, stating where it originates and how far it may propagate. RFC 1997 supplies the general BGP community mechanism; Meta's particular labels are its own policy. A tag tells the next router what the sender asserts. The second check decides whether that assertion is welcome. Meta's Route Registry lists prefixes explicitly allowed across each boundary, then turns those entries into inbound prefix lists under a freshness service level. A guest list copied to yesterday's gate is a guest list with a clock problem.

Third comes the guard with eyes on the live tracks. The Control Plane Health Monitoring system compares actual routing state with the intended identity and permission, flagging wrong communities and unregistered prefixes. The RIPE abstract says this exposed pervasive violations, and that Meta repaired nearly all of them within months before automated enforcement. It gives no count of detected cases, cleared cases or rollback tests. A dated table of the boundary, registry revision, installed filter and observed route would let other operators examine the result rather than applaud the slogan.

RFC 8212 offers a related baseline for external BGP: routes need explicit import and export policy. RFC 9234 defines peer roles and an OTC marker for a different route-leak boundary. Meta's account is about its own cross-domain system. The shared lesson is smaller and sharper: a route's label, an authorization record and the filter actually running are three separate facts.