Detection Types
What each BGP detection means, and how we assign severity and confidence.
Anomalous vs. steady
Every detection is evaluated twice: first “is this a violation?”, then “is this violation new?” The second question is answered against a rolling 30-day baseline. A violation seen before in that window is a known, long-standing condition and is marked steady; one never seen in the window is anomalous.
The internet carries an enormous amount of permanent policy violation (routes that have been RPKI-invalid for years, unregistered legacy space, and so on) — none of that should page anyone. What matters is change, so each type carries two severities: one for the anomalous case, one for the steady case. Alerting only ever considers anomalous incidents.
| Detection | Severity (anomalous / steady) | Confidence |
|---|---|---|
|
rpki_invalid_asn
RPKI Invalid Origin
|
high
/
info
|
high |
|
rpki_invalid_length
RPKI Invalid Length
|
high
/
info
|
high |
|
moas_conflict
MOAS Conflict
|
high
/
info
|
medium |
|
origin_mismatch_new
New Origin
|
high
/
info
|
medium |
|
irr_invalid_asn
IRR Origin Mismatch
|
medium
/
info
|
medium |
|
reserved_as_in_path
Reserved AS in Path
|
medium
/
low
|
high |
|
unallocated_as_in_path
Unallocated AS in Path
|
medium
/
low
|
high |
|
path_loop
AS Path Loop
|
medium
/
low
|
high |
|
first_as_violation
First-AS Violation
|
medium
/
low
|
medium |
|
new_prefix
New Prefix
|
low
/
info
|
low |
|
unregistered_route
Unregistered Route
|
low
/
info
|
medium |
rpki_invalid_asn high
A ROA covers the prefix but the announced origin AS is not authorized by it.
rpki_invalid_length high
The origin is authorized by a covering ROA, but the announcement is more specific than the ROA's max length.
moas_conflict high
Two or more ASNs originate the same prefix within the concurrency window (multi-origin AS).
origin_mismatch_new high
A (prefix, origin) pair is absent from the 30-day baseline — never seen before, or returning after 30+ days dormant.
irr_invalid_asn medium
One or more IRR route objects exist for the exact prefix, and none match the origin AS.
reserved_as_in_path medium
A reserved or private-use ASN (e.g. an RFC 6996 private-range ASN) appears in the public AS path.
unallocated_as_in_path medium
A path ASN is not covered by any RIR delegation (allocated or assigned). Dampered against fresh allocations.
path_loop medium
The same ASN appears at non-adjacent positions in the AS path (legitimate prepending is excluded).
first_as_violation medium
The peer that exported the route is not the first AS in the path, and the peer is not a known route server.
new_prefix low
A (prefix, origin) pair appears that has no prior origin history at all in the registry or baseline — the prefix itself is new, not a mismatch.
unregistered_route low
The route has neither RPKI ROA coverage nor any IRR route object.