BGP Routing Table & Hijack Monitor

Frequently Asked Questions

What is an RPKI-invalid BGP route?

An RPKI-invalid route is a BGP announcement where the origin ASN does not match any valid Route Origin Authorization (ROA) for that prefix. This can indicate a BGP hijack, where a malicious or misconfigured AS is announcing prefixes it does not own, or an operator error such as an expired or misconfigured ROA.

How does ipctl.io detect BGP hijacks?

ipctl.io compares live BGP routes collected from multiple BGP collector sessions against RPKI ROA data. Routes where the announcing ASN is not authorized by a valid ROA are flagged as RPKI-invalid and surfaced as potential hijacks. The authorized ASN from the ROA and the actual announcing ASN are shown side by side.

What is the difference between a BGP hijack and a route leak?

A BGP hijack occurs when an AS announces a prefix it does not own, intentionally or due to misconfiguration, potentially redirecting traffic. A BGP route leak occurs when a valid prefix is re-announced to peers that should not receive it, violating routing policy but not necessarily involving a stolen prefix. RPKI can detect origin hijacks; ASPA is designed to catch route leaks.

Does RPKI fully prevent BGP hijacks?

RPKI Route Origin Validation (ROV) prevents origin hijacks only when the receiving AS enforces RPKI filtering. If a transit provider does not drop RPKI-invalid routes, those announcements can still propagate. RPKI does not protect against path-based attacks or route leaks - ASPA and BGPsec are being developed to address those.

How often is the RPKI-invalid route list updated?

ipctl.io refreshes BGP routing data and RPKI validation results every 15 minutes from live BGP collector feeds. The hijack table reflects routes currently observed in the global routing table that fail RPKI validation.