Summary

  • member-of expresses that a route, route6, aut-num or inet-rtr object wants to belong to a set; the claim is valid only when the set's mbrs-by-ref rule recognizes one of the object's mnt-by maintainers.
  • That result proves an authorized RIPE Database relationship at the relevant update state. It does not prove that a prefix is announced, accepted, selected, reachable or carrying traffic.

Membership has two authors

RIPE NCC documents two ways to build a set. The set object can list values directly in members, or another object can claim membership through member-of. The second route is deliberately bilateral. The member names the set, while the set names, through mbrs-by-ref, which maintainers may make that claim.

The database compares the candidate object's mnt-by attributes with the set's accepted maintainers. If the claim is invalid when the member object is created or modified, the operation fails. If the set has no mbrs-by-ref, membership is defined explicitly by its own members attributes instead. A bare member-of line therefore is not self-authenticating evidence.

What the accepted update proves

Acceptance supports a narrow, reproducible statement: at that update state, the object and set satisfied the documented membership authorization rule. An evidence ledger should preserve the member object's key, the set name, both relevant attributes, the database source and the observation time. Historical comparison should record later changes rather than treating the first accepted state as permanent.

Route sets can contain prefixes and other route sets. Operators may expand them when generating policy, but expansion remains a database computation. The RIPE Database did not observe a BGP session, inspect a router's imported configuration or measure the data plane merely because it accepted the relationship.

Add the network evidence separately

RIPE RIS Live is a different evidence surface: it provides time-stamped BGP messages seen by RIPE RIS collectors, including announcements, withdrawals, peers and AS-path attributes. That observation is bounded by collector and time. Neither a database membership nor a RIS message, by itself, establishes router deployment, end-to-end reachability, carried traffic or a commercial relationship.

This separation does not diminish the registry. It makes its authority legible. RIPE Database can enforce who may add an indirectly maintained member; network operators separately decide how, when and whether to consume the resulting set.

Sources