IRR Validator

A set of databases where operators record what they intend to announce and who may announce it, as RPSL objects: route and route6 for prefixes, as-set for groups of ASes, aut-num for the ASes themselves, and mntner for the handles that maintain them. Most of the prefix filters between networks are still generated from this data, which is why a missing or wrong object shows up as “my route isn’t propagating”.

Because the IRR is not one database. The same prefix is routinely registered in several registries, occasionally with different origin ASes, and objects nobody cleaned up outlive the arrangements that justified them. Nothing here picks a winner: every registry’s copy is shown with the registry it came from, because that is part of the answer. A prefix registered in one registry with the right origin and in another with an old one will pass some networks’ filters and fail others.

An as-set lists members, and those members are usually other as-sets, and that nesting is how customer cones are written. Expanding one follows it all the way down to the member AS numbers, then takes the second step to the prefix list those ASes have route objects for. That is the same thing bgpq4 produces, and the thing you actually need when a customer hands you an as-set. Members are followed across registries, because a set defined in RADB routinely names one that only exists in RIPE.

They answer the same question with different authority. A ROA is cryptographically signed and traces to an RIR trust anchor; an IRR route object is an ordinary database record, as trustworthy as the registry it sits in and whoever last touched it. In practice you need both: filters are still built from the IRR, and RPKI is what catches the cases where the IRR is wrong. The looking glass shows both for every path.

Each registry’s published dump is re-imported every four hours, and most registries regenerate those dumps daily. The cards above say when each one was last loaded. When a lookup finds nothing in the dumps, it asks RADB’s whois server directly, which mirrors every registry here within minutes, and keeps what it finds until a newer dump includes it. Tick Live query RADB (or send live=true) to check live even when the dumps do have an answer; anything that differs is updated here too. Objects that came from a live query are marked live.