Every announcement from — of — routed Norwegian ASNs is RPKI-valid, while — have no valid route at all. Only — routed ASNs publish ASPA. — high-severity findings need attention first, including — RPKI-invalid route(s).
Daily snapshots: share of routed ASNs whose every route is valid, and share of announced IPv4 and IPv6 space that is RPKI-valid.
Each announcement seen by RIPE RIS was validated against the full global ROA set. All valid: every route validates. Partly valid: some routes are NotFound or Invalid. None valid: nothing protected.
ASNs with ROAs, by certificate authority model. Delegated CAs run their own CA and publication; an outage there makes ROAs disappear.
One finding per ASN and issue type. Colour shows severity.
Every ROA prefix (VRP) for Norwegian ASNs. Anything beyond “exact” permits more-specifics; unannounced ones can be hijacked with a forged origin and still validate (RFC 9319).
Top 20 by announced IPv4 space (counted in /24s). Bars show the share of IPv4 space and of all announcements that validate as RPKI-valid.
Sorted by severity, then by the size of the network. Route validity uses exact announcements seen by RIPE RIS and the full validated ROA set.
Each row is a customer AS and the providers it authorises, next to the neighbours RIPE RIS sees on its upstream side (with how many RIS peers see each link). An unlisted neighbour is harmless if it is a peer; an unlisted transit provider makes routes fail ASPA checks. Listed providers never seen may be backup links or stale entries.
Click a column to sort. Unrouted ASNs had no announcement seen by at least 10 RIS peers. Upstream-side neighbours are what an ASPA for that AS would likely need to list.