Measuring Internet Routing Security

The Border Gateway Protocol (BGP) builds the roadmap used by more than 70,000 networks to route Internet traffic from one network to another. An efficient global routing system is critical for increasing performance, decreasing latency, and ensuring a resilient Internet. 

But this global routing system is inherently insecure and increasingly under attack. Every day, the routing system faces incidents such as route hijacking, route leaks, and IP address spoofing. These incidents and attacks can lead to increased latency, slower performance, DDoS attacks, traffic inspection, lost revenue, reputational damage, and more. Mutually Agreed Norms for Routing Security (MANRS) is a global initiative, supported by the Internet Society, that provides crucial fixes to reduce the most common routing threats.

Routing incidents can be global in scale, with one operator’s routing problems cascading to impact others. So how do we measure the overall state of routing security, and what tools can we provide network operators to improve not only their own performance but that of the entire Internet ecosystem?

The MANRS Observatory monitors Internet routing security by aggregating data from trusted sources into a user-friendly dashboard to help network operators improve the security of their networks. The dashboard gives a high-level overview of the state of routing security, MANRS Readiness, and insights into statistics for specific economies.

The Observatory uses publicly available data from sources including BGP Stream, CIDR Report, CAIDA Spoofer, RIPE Stats, and GRIP. The MANRS team regularly adds new features and data sources and makes continuous improvements, but data is still sometimes incomplete, contains false positives (when an event is wrongly marked as a security incident), or contains false negatives (when a security incident goes under the radar).

The Observatory dashboard is open to the public, but MANRS participants can access detailed statistics and reports for specific networks. Partner accounts are available for individuals or organizations to support efforts in promoting MANRS and routing security.

The ROA Stats Tool (ROAST) helps network operators and researchers see the state of Resource Public Key Infrastructure (RPKI) around the world. RPKI is a method of asserting ownership of specific routes and is a key tool in stopping route leaks and hijacks.

The ROA Stats Tool provides an overview of the Route Origin Authorizations (ROAs) created by country or by network, with data updated every day. It gives us a snapshot of the current situation, but also a historical view of ROAs and validation.

The data helps network operators and researchers understand how well networks in a particular country or region are doing regarding RPKI. This could also help them understand their own situation better, including where they might have misconfigurations and can take action to fix them.

The Internet’s routing system enables data to flow from one point to another, and ensuring that this data flows correctly is at the foundation of Internet network security. The Internet is a global, interconnected, interdependent system that requires collective responsibility to keep it secure for all users. Collective responsibility means having a common understanding of the problem, shared solutions, common benefits, and open communication channels. MANRS enables this collective responsibility among participating organizations that are committed to preventing, detecting, and mitigating routing incidents through mutual collaboration and coordination.

By being part of MANRS, more than 600 network operators, Internet exchange points, CDNs, cloud providers, and equipment vendors take concrete actions to contribute to the resilience and security of a critical part of the Internet’s infrastructure.

For more information on how to implement these actions and join MANRS, visit the MANRS website.

Megan Kurse is the Director of Partner Engagement and Communications at the Internet Society. "Working with other organizations helps us move toward our goals farther and faster than we could on our own. I connect the dots between our projects and our external partners, identifying new opportunities and making sure we’re getting the most out of existing relationships. I’m particularly drawn to our more technical projects and think of myself as a Geek-to-English translator who can cut through jargon to explain complicated issues in simple terms."