Summary

  • Usama Ejaz and Antonis Chariton compared observed BGP prefix-origin pairs with IRR objects and RPKI validation from 8 to 14 August 2026. The RIPE 93 original abstract reports exact IRR matches for 64.4% of pairs in the weekly union.
  • Among exact matches, 786 stayed RPKI Invalid for the full week: 371 exceeded ROA maxLength and 415 carried a wrong origin AS. A matching IRR row and a ROA answer different operational questions.

A receipt from the wrong counter

The case looks tidy until two registries disagree. A BGP announcement names a prefix and an origin AS. An IRR route object carries the same pair. Then a covering ROA rejects the prefix length or the origin. In the RIPE 93 presentation record, Ejaz put observed BGP, the exact IRR object, RPKI state and AS-SET membership beside one another. His team treated disagreement as a case for investigation, not a vote to be won by whichever database returns first.

The study's official abstract gives the scale. From 8 to 14 August 2026 it aligned public BGP observations from 57 RIPE RIS and RouteViews collectors, objects from 19 IRR sources and validated payloads from 17 RPKI relying-party views through the week. Across the weekly union, 64.4% of observed prefix-origin pairs had an exact IRR match. Of those matches, 79.9% appeared in just one IRR source. A single matching row could look decisive to an automated filter builder even when another authority disagreed.

The most pointed result was 786 exact-match pairs that remained RPKI Invalid throughout the week. The RIPE NCC origin-validation guide explains the split: 371 advertisements were more specific than a ROA's maxLength, while 415 had an origin AS the covering ROA did not authorize. Each case needs the current resource holder's intended prefix, origin and length to settle what should change. Treating every conflict as the same error would aim the repair at the wrong record.

The old object can keep its seat

The team also retained 140,360 broader-object candidates, a reminder that route objects can outlive the narrower announcements later created beneath them. RIPE's route-object rules show a structural reason for caution: creation in its IRR authenticates against the prefix resource; it does not require authentication by the named origin AS. The record and the ROA have different authority paths.

Ejaz's separate AS-SET replay retained 99.27% of exact IRR matches, but unresolved expansions still needed review. A high retention figure cannot grant an absent origin permission. His contribution is an operator's evidence order: see the announcement, test the exact object, test the ROA, then identify the holder who can correct the conflicting claim.

Sources: RIPE 93 original study abstract; official talk transcript; RIPE NCC origin-validation guide; RIPE Database route-object rules.