When Routing Evidence Conflicts: Measuring IRR and RPKI for BGP Filtering#

Antonis Chariton and Usama Ejaz, Cisco ThousandEyes

• Why: Operators treat IRR route objects and RPKI ROAs as corroborating evidence for the same announcement; this measurement shows they disagree in specific, quantified ways that directly affect filter correctness.
• What: A time-aligned comparison of BGP, IRR and RPKI for 8–14 August 2026 (57 RIS/RouteViews collectors, 19 IRR sources, 18 relying-party views). Findings: 64.6–65.1% of daily public BGP prefix-origin pairs had an exact IRR match, and 79.9% of those matches existed in only one IRR source; 786 exact IRR matches stayed RPKI Invalid all week (371 maxLength, 415 wrong-origin), concentrated in a handful of origins — five ASNs account for 43.4% of maxLength and 50.4% of wrong-origin cases, and 99.5% of the persistent conflicts were registered in a single IRR source; 22.2% of exact-match pairs remained RPKI NotFound. A PeeringDB AS-SET replay retained 99.27% of exact matches.
• How: Daily snapshots at a fixed time, recursive AS-SET expansion through declared IRR sources, consensus classification across relying-party views, and a separate replay of PeeringDB-declared AS-SETs.
• Where applicable: Any edge-filtering pipeline using IRR and/or RPKI. The operational guidance is the point: an exact IRR match does not imply RPKI Valid, and incomplete AS-SET evidence is not grounds to exclude an origin ASN from a filter.