[routing-wg] new tool: rpki-ov-checker

VERY cool job I like it a lot!

This might help me make the case to push the button on dropping RPKI
invalids internally even more.

Thanks for the contribution as always!

- mickod-2110

On Thu, Feb 06, 2020 at 12:41:33PM +0100, Job Snijders wrote:
> I wrote a simple tool to figure out what kind of invalid a rpki invalid
> is, this can aid people in understanding the impact of "invalid ==
> reject" routing policies. Only "invalid_unreachable" routes present
> an operational issue in my opinion, IP addresses covered by "notfound"
> or "valid" less specific routes will still be reachable.
> 
> You pass it a file name (or via stdin) with one prefix and origin ASN
> per line (white space separated) representing your full BGP RIB, and
> then you can grep specific for the task at hand to extract the info you
> need:
> 
> $ rpki-ov-checker full_rib | fgrep -f customer_prefixes | grep invalid | sort -R | head
> invalid_covered_by_notfound 123.101.0.0/21 4809 covering route: 123.101.0.0/16 4134
> invalid_covered_by_valid 46.3.74.0/24 134121 covering route: 46.3.0.0/16 207636
> invalid_unreachable 83.231.209.0/24 3949
> invalid_unreachable 124.30.247.0/24 9583
> invalid_covered_by_valid 125.21.232.0/24 9730 covering route: 125.21.0.0/16 9498
> invalid_unreachable 120.29.92.0/24 17639
> invalid_unreachable 31.40.164.0/24 200872
> invalid_covered_by_notfound 45.12.139.0/24 40676 covering route: 45.12.136.0/22 35913
> invalid_covered_by_valid 122.160.178.0/24 24560 covering route: 122.160.0.0/16 24560
> invalid_covered_by_valid 61.90.251.0/24 21734 covering route: 61.90.192.0/18 7470
> 
> NTT is using this to figure out who we need to help fix their ROA or
> correct their BGP announcements.
> 
> Get the goods at https://github.com/job/rpki-ov-checker
> 
> Enjoy!
> 
> Kind regards,
> 
> Job
> 

-- 
- MickoD <mick at mickod.ie>