Third Party Tools Using RTRlib

In the following sections we give an overview on several software tools, which utilize the RTRlib and its features. These tools range from low level shell commands to easy-to-use browser plugins. For all tools we provide small usage examples; where ever appropriate we will use the RIPE RIS Beacons [1] (see Table 1) with well known RPKI validation results to show case the tool.

Table 1 RIPE RIS beacons for RPKI tests
IP Prefix Valid Origin Result AS12654 valid
2001:7fb:fd02::/48 AS12654 valid AS196615 invalid AS
2001:7fb:fd03::/48 AS196615 invalid AS None not found
2001:7fb:ff03::/48 None not found

Note: for all prefixes RPKI validation results are based on origin AS 12654 that is owned by RIPE. Most examples also require a connection to a trusted RPKI cache server, for that we provide a public cache with hostname and port 8282.

RPKI Validator Browser Plugin

The RPKI Validator plugin for web browsers allows to check the RPKI validation of visited URLs, i.e., the associated IP prefix and origin AS of the URL. A small icon indicates the validation state of the visited URL, which is either valid (valid), invalid (invalid), or not found (not_found).

The plugin is available as an add-on (or extension) for the web browsers Firefox and Chrome . While the Firefox add-on [2] is available through the add-on store, Chrome users have to download and install the extension themselves as follows:

  1. download the Chrome extension [3] from GitHub
  2. open a new tab in Chrome and enter chrome://extensions
  3. activate Developer Mode via the checkbox in the top right
  4. click the Load unpacked extension button and navigate to the source

The screenshots show the results of the RPKI Validator browser plugin for Firefox (valid Fig. 2, invalid Fig. 3, and not found Fig. 4) for certain websites .


Fig. 2 Screenshot of RPKI Validator plugin in Firefox showing result valid.


Fig. 3 Screenshot of RPKI Validator plugin in Firefox showing result invalid.


Fig. 4 Screenshot of RPKI Validator plugin in Firefox showing result not found.


The RPKI Realtime Dashboard (RPKI READ [4]) aims to provide a consistent (and live) view on the RPKI validation state of currently announced IP prefixes. That is, it verifies relation of an IP prefix and its BGP origin AS (autonomous system) utilizing the RPKI.

The RPKI READ monitoring system has two parts:

  1. the backend, storing latest validation results in a database, and
  2. the (web) frontend, displaying these results as well as an overview of statistics derived from them.

The backend connects to a live BGP stream, e.g. of a BGPmon [5] instance or via BGPstream [6]. It then parses received BGP messages and extracts IP prefixes and origin AS information. These prefix to origin AS relations are validated using the RTRlib validator to query a trusted RPKI cache server.

The RPKI READ frontend presents a dashboard like interface showing a live overview of the RPKI validation state of all currently advertised IP prefixes observed by a certain BGP source (see Fig. 5). Further, the frontend provides detailed statistics and also allows the user to search for validation results of distinct prefixes or all prefixes originated by a certain AS.

RPKI READ screenshot

Fig. 5 Screenshot of the RPKI READ web frontend


The RPKI Monitoring and Inspection of RPKI Objects (RPKI MIRO [7]) aims for easy access to RPKI certificates, revocation lists, ROAs etc. to give network operators more confidence in their data. Though, RPKI is a powerful tool, its success depends on several aspects. One crucial piece is the correctness of the RPKI data. Though, the RPKI data is public, it still might be hard to inspect outside of shell-like environments.

The main objective of RPKI MIRO is to provide an extensive but painless insight into the published RPKI content. RPKI MIRO is a monitoring application that consists of three parts:

  1. standard functions to collect RPKI data from remote repositories,
  2. a browser to visualize RPKI objects, and
  3. statistical analysis of the collected objects.
RPKI MIRO screenshot

Fig. 6 Screenshot of the RPKI MIRO web interface.

Using RPKI MIRO you can lookup any IP prefix and its associated ROA, e.g. the RIPE RIS beacon Open a browser and goto URL, in the menu switch from AFRINIC to RIPE and set a filter for the prefix with attribute resource. Expand the ROA tree view on the left side to get the corresponding ROA for the beacon prefix, the resulting web view should look like the screenshot in Fig. 6.


The RPKI RESTful BGP Validator (RPKI RBV [8]) is web application that provides a RESTful API to validate IP prefix to origin AS relations. The validation service can be accessed via a plain and simple web page (see also Fig. 7) or directly using its RESTful API.

RPKI RBV screenshot

Fig. 7 Screenshot of the RPKI RBV web interface

RBV provides two distinct APIs to run RPKI validation queries, the APIs allow RESTful GET queries with the following syntax and formatting of the URL path:

  1. /api/v1/validity/<asn>/<prefix>/<masklen>
  2. /api/v2/validity/<host>

Note: the AS number in <asn> has to be prepended with AS; and <host> can either be an IP address or a DNS hostname. To test the APIs type the following queries for the RIPE RIS beacon into the address bar of your favorite web browser:

The result will be a JSON object as shown in Listing 13.

Listing 13 Sample JSON output of RPKI RBV
    "validated_route": {
        "info": {
            "origin_country": "EU",
            "origin_asname": "RIPE-NCC-RIS-AS Reseaux IP Europeens Network Coordination Centre (RIPE NCC), EU"
        "route": {
            "prefix": "",
            "origin_asn": "AS12654"
        "validity": {
            "state": "Valid",
            "code": 0,
            "description": "At least one VRP Matches the Route Prefix",
            "VRPs": {
                "unmatched_as": [],
                "unmatched_length": [],
                "matched": [{
                    "prefix": "",
                    "max_length": "24",
                    "asn": "AS12654"

For detailed instruction how to install and set up the API visit the RBV Repository on GitHub [9].