IPXpert · Network engineering
Interpret RPKI origin validation without overstating security
RPKI origin validation answers a specific question: does the available validated ROA data authorize this origin ASN for this prefix length? It does not validate the complete AS path or prove that traffic is delivered.
Technical review: · فارسی
Understand each state
VALID means at least one covering validated authorization matches the origin and permits the announced prefix length. INVALID means covering authorization exists but the relevant origin or permitted length does not match. NOT_FOUND means no covering validated authorization is available in the dataset.
ERROR and UNAVAILABLE in IPXpert describe an unsuccessful or missing validation source. They are operational data-quality states, not synonyms for NOT_FOUND and not a reason to invent a validity decision.
A prefix-and-origin workflow
- Run a BGP lookup and record the actual matched prefix and each observed origin. Do not substitute the allocation holder’s ASN for the reported origin.
- Check each prefix/origin pair. With multiple origins, inspect every result rather than treating one VALID origin as proof that all observations are authorized.
- For INVALID, compare the origin ASN and maxLength in the covering ROA. A more-specific announcement may exceed the authorized maximum even when the ASN is correct.
- Check validator freshness and the operator’s intended policy before changing ROAs or route filters. Verify from a second current source when the first source is unavailable.
Invalid is a signal to investigate
INVALID alone does not establish a malicious hijack; configuration and authorization errors are possible. VALID is also not a blanket guarantee against route leaks or path manipulation. This site reports evidence and does not prescribe automatic changes to production filtering.
Use the actual tool
The Looking Glass reports validation for the origins it observes. Results are current-source dependent and may change after a ROA update or validator refresh. There is no promise that a saved screenshot remains current. This service does not issue ROAs or replace an operator’s routing security policy.