Dynamic routing

RPKI (route origin validation)

Also called RPKI, ROA, route origin authorization, origin validation, ROV, RTR, BGP hijack, prefix hijack, match rpki invalid

Signed records saying which AS may originate a prefix, so a router can drop routes from anyone else.

Address holders sign ROAs (prefix, longest length allowed, origin AS) in their regional registry's RPKI. A validator fetches and checks them and serves the result to routers over RTR. Each route is then valid, invalid (wrong origin or too long) or not found; a policy such as match rpki invalid with deny drops the invalid ones. It checks only the origin: a forged path ending in the right AS still passes.

See it on real machines

Learn it on real machines.