How to use it
- 1.Enter a prefix such as
193.0.0.0/21or2001:67c:2e8::/48, or a single IP address to find the announced prefix it belongs to. - 2.If you’re preparing a new announcement, add the AS you’ll announce from, for example
AS3333. - 3.Click Look up. The top of the result says whether BGP, RPKI and the IRRs agree, and what to fix if they don’t.
- 4.Switch between the tabs for the details: the announcement with visibility and AS paths, the ROAs, and every route object with its IRR. To check many prefixes, choose “Several prefixes” and paste one per line.
Before you announce a prefix
Whether another network accepts a new route is up to its routing policy. Two checks matter most. RPKI: a ROA, signed in your registry’s portal, must name your origin AS and a max length at least as long as the prefix you announce; otherwise the route is RPKI invalid, and networks that reject invalid routes drop it. And the IRR: many transit providers and IXP route servers build their filters from route objects (route for IPv4, route6 for IPv6), so behind such an upstream one must exist with your prefix and origin AS. Ask your upstream which IRR sources its filters use.
If you plan to announce more specifics, for example /24s out of a /22, the ROA’s max length has to allow them, or they are RPKI invalid while the /22 itself is valid. Keep the max length as short as you need: a generous max length lets an attacker announce a more specific route with your AS as the origin.
Create the route object in the database of the registry that manages the space (RIPE, ARIN, APNIC, LACNIC or AFRINIC). Objects in RADB or other third-party IRRs are accepted by many networks, but not all of them.
What the result shows
Visibility counts the route collector peers of RIPE RIS that see the exact prefix. A well-announced prefix is seen by nearly all of them; a much lower share means that some networks filter it, often because of RPKI or a missing route object.
“Seen through” lists the AS next to the origin in the collected paths. Usually these are your upstreams, but they can also be networks you peer with or an IXP route server, because collectors sit at exchange points too. AS path prepending (the origin repeated) is shown so you can confirm traffic engineering works as intended.
RPKI states follow RFC 6811: valid when a covering ROA names the origin and allows the length, invalid when ROAs exist but none match (wrong AS or too long), and not found when no ROA covers the prefix at all. Validation only labels the route. What happens next is each network’s policy (RFC 6811 leaves it to the operator): many reject invalid routes, others only prefer valid ones or don’t look at RPKI at all.
Questions and answers
How do I check if my prefix is announced?
Enter the prefix and look at Status and Visibility. If it’s announced, you see the origin AS and how many RIPE RIS collector peers see it. A new announcement usually shows up within a few minutes.
What does RPKI invalid mean?
A ROA covers the prefix, but it doesn’t allow this origin AS or this prefix length. RPKI only labels the route, but many large networks, including most big transit providers, reject RPKI-invalid routes by policy. So fix the ROA before announcing: add a ROA for the right AS, or raise its max length to cover the prefix length you announce.
Do I need both a ROA and a route object?
In practice, yes. RPKI protects against hijacks wherever networks reject invalid routes, while many transit providers and IXP route servers still build their prefix filters from IRR route objects. Without a route object, such an upstream may filter your announcement even when RPKI is valid.
Can I check many prefixes at once?
Yes. Choose “Several prefixes” and paste up to 50 prefixes, one per line, optionally each followed by the AS you plan to use. You get the announcement status, the RPKI state and the route objects for every line, and can copy the result as CSV or open any prefix in detail.
Why does my prefix show a different origin AS?
Either the prefix is still announced by a previous holder or your provider, or it’s announced by mistake or hijacked. Compare the origin with your ROA and route objects; if it isn’t yours, contact the origin network and your registry.
How current is the data?
BGP visibility and AS paths come from RIPE RIS and are minutes old. Route objects and ROAs pass through several mirrors and validators first, so a change you just made can take a few hours to appear.