Summary

  • The NATO Support and Procurement Agency (NSPA) holds the RIPE provider-independent block 193.168.8.0/21 under netname NAMSA, registered in Capellen, Luxembourg, and operated through its own low-visibility autonomous system AS210872.
  • The block is split in global routing: AS210872 originates the lower two /24s, while POST Luxembourg (AS6661) originates two other /23s from the same NSPA-registered space.
  • Aggregator prefix counts that disagree (512 vs 1,024 addresses) are both correct in what they measure: registry holding and route origination are different facts.
  • The parent /21 is never announced as a single aggregate, which is why the whole story is invisible unless a reader looks at the RIR account level.
  • Open questions remain on live upstreams, ROA validity for one /24 and the absence of reverse DNS or hosted domains in probe data.

NSPA is the logistics arm of NATO: an agency of the alliance that provides logistics, procurement and operational support services to NATO nations and partners, headquartered in Capellen, Luxembourg, and a successor to the former NAMSA. The Luxembourg government underscored the agency's role at its 75th anniversary reception in March 2024, calling it central to alliance logistics support.

What does that organisation's network look like from the public internet? The registry answer is unusually clean. The RIPE account for NSPA holds 193.168.8.0/21 as provider-independent IPv4 space, plus a 2a14:e480::/29 IPv6 block, under autonomous system AS210872. The inetnum object behind the space reads 193.168.8.0 - 193.168.15.255, netname NAMSA, country LU, status ASSIGNED PI, maintained by NSPA-MNT, NAMSA-AOET, RIPE-NCC-END-MNT, with route maintenance authority additionally delegated to AS6661-MNT and CEGECOM-LU-MNT.

The routing answer is more fragmented. The bgp.tools AS210872 record shows the low-visibility system operating under the AS name NSPA, with organisation ORG-NSA90-RIPE, the website nspa.nato.int, IRR policy naming AS6661 and AS6939 as authorised upstreams, and two IPv4 prefixes plus one IPv6 prefix originated. CheerVision's ASN view confirms the /24-only half for AS210872: 512 IPv4 addresses in the two /24s, network name NAMSA, registry RIPE_NCC, ASSIGNED PI. Qrator Radar's prefix list for the ASN is broader, listing 193.168.12.0/23 and 193.168.8.0/23 alongside the /24s, with the /23s showing strong propagation (~509/~498) and the /24s in low single digits — and flagging 193.168.12.0/24 as RPKI/ROA Invalid at high severity with propagation around 96 (19.2%).

Other aggregators slice the same reality differently. ipregistry summarises AS210872 as holding 1,024 IPv4 addresses across two /23s (193.168.8.0/23 and 193.168.12.0/23), typed as Government, allocated April 3, 2025 and last updated April 27, 2026. theipapi reports the same two /23s as the ASN's prefixes. Meanwhile bgp.he.net states plainly that the parent 193.168.8.0/21 is a RIPE assignment to NATO SUPPORT AND PROCUREMENT AGENCY and is not visible in the global routing table — the single most important sentence for understanding everything else.

The apparent contradiction between 512 and 1,024 addresses dissolves once registry holding and route origination are separated. The /21 is a holding fact: all 2,048 addresses belong to NSPA in the registry. Origination is a per-prefix routing fact: AS210872 announces only part of its own space, while POST Luxembourg carries two /23s of NSPA-registered space across the internet. Aggregators that map only announced prefixes to the ASN report 512 addresses; those that map registry-allocated space report 1,024. Both are correct about different objects.

The delegation mechanism is visible in the route objects. The route object for 193.168.10.0/23 carries origin AS6661 and was created on 2023-02-22, maintained by AS6661-MNT — visible in the same registry reproduction that documents the inetnum above. The same creation date and maintainer appear for 193.168.14.0/23, where bgp.he.net records POST Luxembourg as origin and NSPA as registrant. Whoer's AS6661 view confirms POST Luxembourg's side of the arrangement, and CEGECOM's maintainer role is reflected in the AS15965 operator record for Luxembourg — the same commercial operator visible at the Luxembourg Internet Exchange, LU-CIX.

Visibility is deliberately low. IPinfo's probe data for the /24 shows zero reverse DNS entries, zero hosted domains and only two pingable addresses across the 256-address range — though the prefix itself is RPKI-valid with a ROA for NATO SUPPORT AND PROCUREMENT AGENCY. Robtex independently marks the AS210872-originated routes (193.168.8.0/24, 193.168.9.0/24, and both /48s of the IPv6 space) as RPKI-valid.

The aut-num record, mirrored by Qrator's whois view, was created on 2025-04-03 and last modified 2026-04-27, with RIPE-redacted contact handles (DUMY-RIPE) and the maintainer pair NSPA-MNT / NAMSA-AOET.

The remaining open questions: does AS210872 announce the /23 aggregate or only the /24 more-specifics in live routing; which of the reported upstreams (AS6661, AS6939, AS49624) are actually live versus stale IRR policy; what the full ROA set says; and why probe data shows no reverse DNS or hosted domains on a network carrying alliance logistics traffic. Third-party block-listing pages corroborate the /21 context and additional mirrors reproduce the ASN record, with PeeringDB listing the system last updated 2026-08-18.