The Internet relies on BGP routing announcements between networks. These announcements have historically depended on trust, allowing errors or hijacks to redirect traffic globally. On February 24, 2008, Pakistan Telecom tried to block YouTube by announcing a more specific route, which its upstream PCCW Global accepted, redirecting YouTube traffic globally for roughly two hours. RPKI (Resource Public Key Infrastructure) was designed to prevent this by letting IP address holders publish signed records, Route Origin Authorizations (ROAs), naming allowed networks. Network operators compare announcements against these records and can reject invalid ones.
The share of routed prefixes that are RPKI-valid rose from 54.0% to 70.3% in one year, a gain of 16.4 percentage points, or 30% growth. Much of the jump came from China, which went from 3.7% to 83.0% of IPv4 addresses in valid routes, counting for nearly 60% of the global gain. RPKI grew more in the past year than in the two years before combined. Data shows invalid routes barely propagate; routes failing RPKI checks are seen by just two vantage points, while valid ones are seen by 596. Nearly half of all invalid routes reach only a single vantage point.
Spain has the highest share of invalid IPv4 prefixes at 28.2%, but weighted by visibility, this falls to 0.057%. Italy has the highest figure for countries with at least a million IPv4 addresses at 0.121%, largely due to WIND TRE (AS1267) announcing 34 routes its own ROAs do not allow.
RPKI is doing what it was designed to do. As more networks adopt it, invalid routes are being dropped, improving overall Internet routing security and stability.
Source: Hacker News · Summarized by HeadlinesBriefing