The End of Prefix Filtering#

James Bensley, Inter.link

• Why: A deliberately provocative operator thesis with data behind it: IRR-derived prefix filtering may now cost more to generate, deploy and maintain than the security it adds, and ROA coverage has grown enough to switch edge filtering to RPKI alone.
• What: A three-way comparison of DFZ, IRR and ROA datasets (single-day snapshots) showing DFZ data tracking ROA data more closely than IRR, IRR containing substantial redundancy, and redundant ROA data beginning to accumulate; decision-flow analysis of what each filtering combination actually rejects; and the observation that tier-1 transit feeds are already accepted as full tables without prefix or AS-path filters.
• How: Snapshot-based dataset comparison plus stepwise filter decision trees (origin in AS path → ROA valid/unknown → IRR presence → reject/accept), ending with the "are we there yet?" assessment.
• Where applicable: Explicitly scoped to the standard edge case (excludes RTBH, private ASNs, Flowspec). Read it against When Routing Evidence Conflicts in the same program — that talk quantifies exactly the IRR/RPKI disagreements that make a wholesale cutover non-trivial. Operator judgment required; the debate itself is the value.