Assessing the feasibility of routing security compliance tests#

Moritz Müller, Lisa Bruder — SIDN Labs, University of Twente

• Why: Routing-security hygiene (MANRS and its elevated "MANRS+" tier) has been self-attested; this work asks whether it can be measured — and builds an open-source, containerlab-based harness to do it. Two interests in one: routing security plus a transferable use of Containerlab as an automated audit testbed.
• What: A prototype that audits an AS's routing-security controls (route origin validation, customer prefix filtering, bogon filtering) by standing up the audited AS between two local ASes in a containerlab topology: one exports prefixes to it, the other imports what it re-advertises. Analyzing the imported prefixes reveals the filters actually configured. In the testbed it reliably audits correct filter implementation — for example, by mutating a route object to disallow a prefix and observing whether the audited AS stops exporting it.
• How: Fully containerized local testbed (code open source on GitHub as SIDN/manrs-prototype); import filters compiled with bgpq4 against IRR; test prefixes withdrawn immediately to avoid unintended propagation.
• Where applicable: The prototype works locally; auditing production ASes is future work with identified pitfalls (RPKI/IRR propagation delays, multi-control-plane ASes, risk of test announcements leaking). The community was being asked for feedback on what a production deployment (led by GCA) should handle. The containerlab-as-auditor pattern is adoptable by anyone wanting to verify routing hygiene of partners or their own network.