Summary

  • Alexander Männel's RIPE 93 plenary slot on 27 October brings July IETF measurements of how quickly RPKI validity changes reach actual forwarding paths to the registry community.
  • In the original slides, an invalid route becoming valid or not-found reached 50% of observed vantage points in nine minutes for multi-homed networks and 12 for single-homed ones. A route becoming invalid took 42 and 30 minutes, respectively.

A resource holder can change a Route Origin Authorisation quickly. The Internet does not gather around the registry counter to watch. The record must travel through repositories, validators and routing policies before packets encounter a different path. RIPE 93 lists Alexander Männel for 27 October to discuss the observed minutes in that relay. His team's original IETF 126 slides were public in July; the Sofia programme puts those findings before the people who operate the registry and networks.

The researchers watched changes at the origin of RIPE's RRDP repository using an optimised validator, then sent traceroutes from more than 300 CAIDA Ark vantage points every three minutes for an hour. Their November-to-January observation window contained 24,886 ROA transitions affecting validated payloads. Of those, 1,493 moved into or out of INVALID, excluding multiple-origin announcements. The trick is to start the stopwatch before public validators have all caught up: the team's detection preceded the fastest public validator by at least 57 seconds, with a median gap of five minutes and seven seconds.

Two directions produced different clocks. When an invalid state became valid or not-found, the slides report 50% vantage-point reachability after 12 minutes for single-homed networks and nine for multi-homed ones. In the reverse direction, when a previously valid or not-found route became invalid, the 50% point arrived after 30 minutes for single-homed networks and 42 for multi-homed ones. The RIPE session abstract condenses these as 9–12 and 30–42 minutes. That slower second clock is the one an operator should remember when expecting a newly invalid announcement to stop carrying traffic.

This is a governance problem with several clocks and several owners. RIPE NCC publishes repository material; each relying party decides when to fetch and validate it; networks decide how they consume validated data and apply route-origin policy. The slides' 50% vantage point is a measured milestone, not a timetable for every network. The one-hour traceroute window leaves longer tails outside the experiment. The researchers also say their RIPE RIS classification of single versus multiple upstreams can misclassify some networks. Those details shape a credible incident plan more than a green validity badge alone.

The researchers suggest making ROAs before trouble and shortening validator refresh intervals to ten minutes or less. That is an operator prescription, not a new RIPE rule. The useful question for the Sofia discussion is who can show timestamps at each handoff: ROA publication, validator update, router policy and changed reachability. Without that chain, the registry can truthfully say a record changed while the packet is still taking the scenic route.

Original sources