Summary

  • At RIPE 78 in 2019, the community asked the meeting network to drop invalid RPKI routes and wanted a visible check. Nathalie Trenaman's RIPE Labs account credits Emile Aben, Jasper den Hertog and Job Snijders alongside her on the experimental browser test.
  • The test fetched from two deliberately different prefixes: one with a valid ROA, one invalid. A successful valid fetch paired with an unsuccessful invalid fetch gave a strong indication of route filtering from that user's network. RIPE Labs still lists the Webtest, and the RIPE NCC RPKI guide still points readers toward checking whether their network drops invalid routes.

The audience at RIPE 78 had a reasonable demand. The meeting network was configured to reject invalid Route Origin Validation results. A configuration statement can live happily on a slide while a laptop's packets take a different path. People wanted to see what happened from their own connection. Trenaman's 2019 account gives the answer in the form of a tiny experiment.

The team put a web server behind each of two test prefixes. One prefix had a valid Route Origin Authorisation; the other was deliberately invalid. A browser on a filtering network should reach the first server and struggle to reach the second. The valid route was the exam's control question. Without it, a broken connection could masquerade as good routing security.

This was the clever editorial move in an engineering project: make an invisible router decision legible to the person affected by it. The user needed a browser and the path already carrying their traffic. Her article calls the result a strong indication about the network a user is on. That phrase earns its place. A web fetch observes an outcome on one path; finding the decisive router takes the operator's route-level investigation.

The first version had a clock ticking. The team wanted it ready before RIPE 78 ended, and the RIPE Labs post says it launched on IPv4. It also names the other contributors. The four-person team built the probe; Trenaman explained it and put the question in front of operators: does the network under your feet act as advertised?

The question has stayed useful. RIPE Labs' tools directory describes the RPKI Webtest as a quick check, and the RIPE NCC's RPKI overview offers a link for checking whether a network drops invalid routes. Those listings show the diagnostic idea endured in official guidance. The 2019 experiment supplies the mechanics and the limits of the answer.

Routers seldom volunteer for oral exams. Trenaman's group arranged one through a browser: fetch the good route, try the bad one, and let the contrast tell the user where to investigate next. The network still owns its filtering policy. The person on it finally had a question they could ask without borrowing the operator's console.