Network report

What this tool checks

Enter an IP address, a prefix such as 193.0.0.0/21, or an AS number such as AS13335 (or just 13335). The report runs the site's own network checks and puts them on one page:

• Routing and RPKI: the route that carries the address or prefix in the global routing table, its origin AS, whether each origin is RPKI valid, invalid or has no ROA, whether an IRR route object exists for it, and how many RIPE RIS peers see it. For a prefix it also says whether it is announced exactly, only as part of a bigger route, or only as more-specific routes, and checks the RPKI state of those more-specifics. For an AS number it counts the IPv4 and IPv6 prefixes it announces, the share of them that is RPKI valid, the ones without a route object, and its upstreams and peers.
• Bogons: special-purpose space (private, documentation, reserved) in BGP, a private or reserved origin AS, and space that no regional registry has handed out.
• Blocklists (IPv4 addresses): the same lists as the Blacklist check, with the removal page of any list that has the address.
• Reverse DNS: for an address, its PTR name and whether that name resolves back to it (forward-confirmed reverse DNS); for a prefix, whether its in-addr.arpa or ip6.arpa zones are delegated.
• Registration: the holder and abuse contact from the regional registry over RDAP, as in the WHOIS lookup, plus the RIR, country and date from the delegation statistics.
• PeeringDB: the network's PeeringDB record, its peering policy and contacts.

Routing data comes from RIPEstat (RIPE NCC's Routing Information Service and Routinator), fetched in parallel and cached for a few minutes; AS names come from Team Cymru. A report usually takes 3 to 10 seconds; a very large network can take longer the first time.

Reading the results

The first line is the answer: who announces it and in which route, or why it is not routed. Under it are the key facts, then What to fix: problems first (an RPKI-invalid route, an announced bogon, a blocklist listing), then warnings (no ROA, no route object, no reverse DNS, no abuse contact, a network that peers without a PeeringDB record). Each item has its fix, a record or ROA to copy where there is one, and a link to the tool that shows it in full.

Checks has one line per section. Open a line to see everything it found, the data behind it and a link to the full tool.

For an address or prefix, the PeeringDB section is about the network that announces it, which is often your provider rather than you, so it is shown but kept out of the fix list.

Common problems and fixes

RPKI invalid

A ROA covers the route but names another origin AS, or a shorter maximum length. Networks that validate RPKI drop the route, so part of the internet cannot reach you. This often happens after moving to a new provider or adding DDoS protection. Create a ROA for the AS that announces the route (keep the old one until the move is finished), or one for exactly the prefix you announce. The ROA guide walks through it at each registry.

No ROA

The route is "RPKI not found": accepted almost everywhere, but nothing stops someone else announcing it. Create a ROA with your origin AS and a maximum length equal to the prefix length.

No route object

Many networks build their prefix filters from IRR data. Create a route (IPv4) or route6 (IPv6) object in your registry's IRR database:

route:  192.0.2.0/24
origin: AS64500

Listed on a blocklist, or no reverse DNS

Mail from the address is rejected or sent to spam. Fix the cause, then use the removal link. A mail server also needs a PTR name that resolves back to its address. Why is my email going to spam? has the full checklist.

No abuse contact

Reports about spam or attacks from your space go nowhere, and blocklists may list the whole range. Add an abuse contact to the registration: abuse-c at RIPE NCC, an Abuse POC at ARIN, an abuse mailbox (IRT) at APNIC, AFRINIC or LACNIC.

FAQ