IRR route objects and RADb: why a prefix gets filtered

A route object is a public record that says which AS number may originate a prefix. Upstream providers build the filters on your BGP session from these records, so a prefix without one is often dropped before it ever reaches the wider internet, even when its ROA is perfect. RPKI has not replaced routing registries; most networks still use both.

What a route object is

Routing registries (IRRs) hold objects in a simple text format. The one that matters for an announcement is the route object:

route:   203.0.113.0/24
origin:  AS64500
descr:   Example Customer GmbH
mnt-by:  EXAMPLE-MNT
source:  RIPE

It pairs one prefix with one origin AS. If the block is announced from two ASNs, it needs two route objects.

Where they live

• The RIPE Database is the registry for space in the RIPE NCC service region, and route objects for that space belong there. Creating one needs the authority of the address space's holder, so a stranger cannot register your block.
• ARIN and APNIC run registries for their own space: ARIN's inside ARIN Online, for space under an ARIN agreement, and APNIC's in its Whois Database (ARIN, APNIC).
• RADb, run by Merit, a nonprofit, is a subscription registry that holds objects for space from any region. Many networks query it alongside the regional registries, which is why it turns up in so many setups, and why it is worth checking what it says about your block.

How your upstream uses them

Most providers expand what you are allowed to send into a list of prefixes, automatically, from the registries: your AS number, or an as-set that lists yours and your customers', is looked up, and every route object with a matching origin becomes an entry in the filter on your session. Tools such as bgpq4 do this:

bgpq4 -4 -l allowed AS64500

If the list it prints does not contain your prefix, your upstream's filter will not either. Filters are often rebuilt once a day, so a new route object can take that long to take effect.

Checking what the registries say

whois -h whois.ripe.net -T route 203.0.113.0/24
whois -h whois.radb.net 203.0.113.0/24

You are looking for three things: a route object with your origin AS, no route objects left behind for an ASN that no longer announces the block, and the same picture in the regional registry and in RADb.

Mistakes that get a prefix filtered

• No route object at all. The most common one, and the reason a new lease or a new upstream "does not work" on day one.
• The wrong origin. The object names the ASN of the previous user, or your provider's when you announce it yourself.
• Old objects left in place. They let someone else's filters accept announcements of your block from an ASN that should no longer send them. Remove them when a lease ends or a provider changes.
• Edits the provider makes for you. Under BYOIP some providers create the route object themselves; AWS, for one, updates RADb on its own and says that manual changes naming its ASN make provisioning fail (AWS BYOIP).

Route objects and RPKI together

A ROA and a route object describe the same thing, the prefix and the AS that may originate it, for two kinds of check. Keep them in step: change both in the same window whenever the origin changes, and check both from outside your own network (RPKI and ROAs).

Where RTM Networks fits

For space leased from us, we create the route object for your ASN, or your provider's, as part of the lease, together with the ROA and, whenever you need one, the Letter of Authorization, and we remove them when the lease ends (lease IPv4).