The Scourge of Excessive AS-SETs#

Doug Madory — Kentik (with Job Snijders)

• Why: A routing-security postmortem plus measurement study showing exactly how IRR-based filtering breaks down and what the replacement path looks like — squarely in the PM's BGP/security interests.
• What: Case study of the March 11, 2024 MTS (AS8359) leak of 30,000+ HKIX routes to Lumen and Arelion — exacerbated by AS-MTU, an AS-SET that expands to 43,823 ASNs (~52% of all ~83,617 routed ASNs). bgpq4 against AS-MTU produces a 1.29M-line Junos filter (271k lines even aggregated), covering 1.8 billion of the ~3 billion IPv4 addresses in the table. 2,192 AS-SETs expand to over 1,000 ASNs; nested recursion mixes customer/peer/IXP-member semantics — one traced chain runs Ukraine → Bulgaria (Balkan-IX) → NL-IX → Russia (TTK) → China (CN2) → South Africa → CTGNet → Rostelecom, ending at an unrouted ASN. Expansion also varies by source IRR (APNIC/RIPE/RADB), so authoritative sources must be declared in PeeringDB.
• How: Demonstrated with bgpq4, Job's irrtree, and bgp.tools data; proposed hygiene (minimum membership, minimal recursion) acknowledged as unrealistic at global scale, with the real fix being RFC 9234 (BGP roles / in-band leak signaling) plus RPKI ASPA verification and future signed prefix lists.
• Where applicable: Any operator generating BGP filters from IRR AS-SETs — no special scale required. The ASPA/signed-prefix-list direction is the globally relevant follow-on for route-leak mitigation.