When Routing Evidence Conflicts: Measuring IRR and RPKI for BGP Filtering

Network operators use customer AS-SETs and Internet Routing Registry (IRR) route objects to construct prefix filters, and Resource Public Key Infrastructure (RPKI) data to validate route origins. These sources represent different forms of routing evidence and may produce conflicting results for the same BGP announcement.
We present a time-aligned comparison of BGP, IRR, and RPKI from 8–14 August 2026. The analysis covers public BGP prefix-origin pairs observed by 57 RIPE RIS and RouteViews collectors, objects from 19 IRR sources, and validated VRP sets from 17 RPKI relying-party views available throughout the week, with an additional view included on 8 August. We also conduct a separate 8 August replay by recursively expanding PeeringDB-declared AS-SETs through their selected IRR sources.
Across the weekly union, 64.4% of observed prefix-origin pairs had an exact IRR match, and 79.9% of those matches appeared in only one IRR source. Among the exact matches, 786 remained RPKI Invalid throughout the week: 371 due to maxLength and 415 due to wrong-origin. We also identify 140,360 retained broader-object candidates. The PeeringDB AS-SET replay retained 99.27% of exact IRR matches, while incomplete or unresolved expansions required further review.
The results show that an exact IRR match does not imply an RPKI Valid state and that incomplete AS-SET evidence cannot justify excluding an origin ASN from a filter. We conclude with operational guidance for investigating conflicting evidence before changing route filters.