routing · severity high
RPKI route origin validation
Share of networks that announce routes but publish no RPKI ROA — their route origins cannot be validated, so a hijack of their prefixes is indistinguishable from a legitimate announcement.
Measured every Sunday · last updated
How it is measured
bulk feeds only — no network is probed. RIPE RIS gives the ASNs actually announcing routes (the population, so dormant allocations don't inflate the rate); the five RIR delegated-extended files give country and RIR (the segments); the RPKI validated ROA payload gives which ASNs publish ROAs. Population unit: ASN; segmented by country and RIR.
Why it matters
~37% of announcing networks publish no ROA. Their route origins cannot be validated, so a hijack of their prefixes is cryptographically indistinguishable from a legitimate announcement — traffic can be diverted with nothing to reject it.
Limits of this measurement
Measures ROA publication, not per-prefix validation state — an ASN with a ROA may still announce prefixes its ROAs don't cover. Segments are country/RIR, not company size: a different axis, stated as such rather than forced into the SME frame.
The base rate
Measured over the full population of networks, from public bulk sources.
Every segment
Pick one to see the citable answer, with its trend and methodology.
Show the remaining 74 segments
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.