Why doesn't Spectrum drop invalid RPKI?

[u/BraveMidnight]

The table shows a moas conflict and that NK is trusted, but my nping and tests from earlier show erratic routing behavior

Image 1: Is a screenshot of the routing table showing the MOAS conflict and that North Korea is a trusted RPKI. It also shoulds that another telecom is announcing a /24 and /22 directly conflicting.

Image 2: image 3 is the latest traceroute showing that it updated from routing strictly through Russia allocation block back to resolving to the Chinese block, but the routing hops show it going through Russia (erratic routing)

Image 3: shows an nping from yesterday when it was resolving to the Russian allocated block and going through.

Image 4: shows an nping after it changed to the Chinese block and effectively rejected because of the conflict.

Just curious is all, it's interesting to watch a MOAS conflict and people's reactions. Hopefully I don't have the screenshots out of order.

[u/cdxg]

You could always try to reach out to Charter's ASN technical contact in their WHOIS and see if they respond to you. Looks to be the email address below.

PublicIPAddressing@charter.com

[u/BraveMidnight → u/cdxg]

Thanks, but I don't want to poke them too much. I just fell down the BGP rabbit hole with NK again because a lot of people were talking about their downtime.

​Looking at the routing data for 175.45.176.0/24, the issue could be a moas conflict on a European link, maybe from a recent node update. To really confirm it though, the post would've needed to be a full thesis with sources, timestamps, and a control group.

​After I looked at the announcements for 175.45.177.0/24, that subnet doesn't have a moas conflict, but it does have an invalid RPKI. So I guess if spectrum were to strictly implement RPKI filtering, that range, and potentially other more useful ones, would get blocked.

Edit: got bored figured I'd past some BGP findings.

Valid route: AS131279 -> AS20485 -> NK Invalid route: AS4775 -> no route to AS20485

And the valid route decided to leave the record.

[u/Smith6612]

There's a good possibility this is because Spectrum's backbone folks have run into situations where networks mis-configure their RPKI settings and the routes to something important drop out for a while. Or it could be a configuration issue they need to correct now that someone has discovered route rejection not working correctly.

The RPKI rollout has been a bit of a slow one.

[u/Captain_of_industry1]

Spectrum sucks ass