Summary

  • RFC 8210 defines a cache serial as a wrapping, strictly increasing logical version inside one cache lineage; serials are not commensurate across caches, sessions or protocol versions.
  • A router’s completed receipt, the cache session, refresh and expiry timers, and upstream validation observations are separate evidence. None can be inferred from the serial value alone.
  • Freshness monitoring should preserve a time-bounded synchronization ledger rather than sort caches globally by serial number.

The tempting comparison is simple. Cache A reports serial 90,000 and cache B reports serial 12,000. A dashboard sorts the numbers and marks A as newer. Every displayed value may be correct, yet the conclusion is unsupported.

RFC 8210 defines the Serial Number as a 32-bit strictly increasing unsigned integer that wraps. It denotes the logical version of a cache. The cache increments it after successfully updating its data from a parent cache or primary RPKI data, and it must not expose the new serial’s payload until that fetch is complete.

That sounds chronological, but only within the right scope. The same RFC says serials are not commensurate between different caches or protocol versions and need not survive a cache reset. A Session ID identifies a cache instance and binds it to the sequence of serials generated by that instance. Full commensurability requires protocol version, session ID and serial together.

A serial therefore behaves like a position in one local sequence, not a universal clock. A newly started cache can hold current data at a low serial. A long-running cache can have a high serial while its last successful upstream refresh is older. Comparing their numbers discards the identity that gives either number meaning.

The router-to-cache exchange preserves another boundary. A router sends a Serial Query asking for changes after its current value. When the cache retains enough history, it sends the minimum merged set needed to synchronize the router. When it does not, it requests a reset and full data transfer. Only after the router receives the complete response does it adopt the serial in the End Of Data PDU.

That completion event matters. A cache may already have moved to a new logical version while a router has not yet received it. A notification is only a hint to poll. The router’s own current serial is evidence of the last complete dataset received from that cache, not proof of the newest state available elsewhere.

RFC 8210 also keeps time separate from sequence. Refresh and Retry intervals guide later queries. The Expire interval limits how long previously fetched data may remain in use without another successful query. The countdown begins upon receipt of the End Of Data PDU. A serial cannot reveal how much of that interval remains.

Repository manifests reinforce the distinction. RFC 9286 uses a monotonically increasing manifestNumber, but it separately carries thisUpdate and nextUpdate time fields and specifies checks for stale or prematurely issued manifests. Sequence and wall-clock validity are different evidence even within one publication lineage.

A useful freshness ledger must therefore record the cache identity, protocol version, session ID, serial, successful End Of Data receipt time, advertised refresh/retry/expire values, last successful upstream validation observation, and the trust-anchor and policy context. If upstream repository evidence is available, its manifest timing belongs in its own row rather than being guessed from the RTR serial.

This structure also clarifies uncertainty. A router may prove that it completed serial 200 in session X at 10:04 and that the data has not expired. It still cannot prove from those facts alone that another cache had no later upstream state, that all repositories converged, or that another router received identical payloads at the same moment.

No cache failure or stale-routing event is alleged here. The point is evidentiary: a serial is useful precisely because it orders states within a commensurate lineage. Asking it to function as global time removes the scope that makes it trustworthy.

Sources