MANRS Observatory: Tracking Internet Routing Security

The Internet’s backbone relies on the Border Gateway Protocol (BGP), which directs data traffic between autonomous networks. However, BGP’s design lacks built-in security, making it vulnerable to hijacks, leaks, and misconfigurations that can disrupt services worldwide. Enter the MANRS Observatory, a powerful tool launched to provide unprecedented visibility into the state of global routing security.

Understanding the Routing Security Challenge

Routing security has become a pressing concern as the Internet scales. BGP incidents—such as prefix hijacks where attackers falsely claim ownership of IP address blocks—can reroute traffic through malicious paths, leading to data interception, denial-of-service attacks, or widespread outages. Historical events, like the 2018 Amazon route leak or state-sponsored hijacks, underscore the risks.

Without robust safeguards, even minor errors propagate globally. Network operators need reliable metrics to assess their posture and the broader ecosystem. The Mutually Agreed Norms for Routing Security (MANRS) initiative addresses this by promoting best practices among operators, Internet Exchange Points (IXPs), and content providers.

What is MANRS and Its Core Principles?

MANRS is an industry-driven effort to establish voluntary standards for secure routing. Participants commit to four key actions:

• Filtering: Prevent announcing invalid routes to peers.
• Anti-Spoofing: Block traffic with forged source addresses using Source Address Validation (SAV).
• Coordination: Maintain accurate contact details for rapid incident response.
• Global Validation: Publish routing policies in public registries like Internet Routing Registries (IRRs) and Resource Public Key Infrastructure (RPKI).

These actions form a foundation for resilience, reducing common threats through collective accountability.

The Birth and Purpose of the MANRS Observatory

Launched in 2019 by the Internet Society in collaboration with MANRS, the Observatory aggregates passive data from trusted sources to evaluate all public networks—over 80,000 autonomous systems (ASes)—without requiring participation. It measures ‘MANRS Readiness,’ a score reflecting compliance with security norms.

Key goals include:

• Providing transparent, factual insights into routing health.
• Tracking trends in incidents, RPKI deployment, and IRR completeness.
• Empowering operators to benchmark and improve their networks.

By visualizing data on an interactive dashboard at observatory.manrs.org, it democratizes access to critical metrics.

Key Metrics and Data Sources

The Observatory pulls from high-quality, public datasets:

These passive measurements ensure objectivity, though challenges like false positives exist. Ongoing refinements incorporate community feedback.

Navigating the Interactive Dashboard

The dashboard offers intuitive views:

• Overview Tab: Global or regional snapshots of incidents, affected networks, IRR/RPKI quality. A world map highlights hotspots by economy size.
• History Tab: 12-month trends since January 2019, revealing progress like rising RPKI adoption from <10% to over 40% in some regions.
• Network Search: Drill into specific ASes for detailed reports, e.g., missing ROAs or IRR gaps.

Operators can filter by time, region, or metric, fostering targeted improvements.

Revealed Trends and Global Insights

Early data exposed stark realities: thousands of monthly incidents, with developing regions lagging in RPKI (e.g., Africa at <20% coverage vs. Europe’s 50%). MANRS members consistently outperform, validating the initiative’s impact. Over time, incident rates have declined in monitored areas, correlating with adoption.

Recent stats (as of 2023):
– 1,200+ MANRS participants covering 10,000+ networks.
– Global RPKI ROAs: >100 million, but validity gaps persist.

Impact on Network Operators and Ecosystem

For operators, the Observatory is a wake-up call and roadmap. Non-compliant networks risk reputational damage and peer distrust. IXPs use it to enforce filtering at route servers. Enterprises select MANRS-compliant providers for SLAs.

Broader effects include accelerated RPKI rollout and policy advocacy. Studies confirm MANRS networks exhibit 2-3x better security practices.

Challenges and Paths Forward

Limitations include data incompleteness and adoption barriers in legacy systems. Future enhancements: AS Path Validation (ASPA), AI-driven anomaly detection, and mobile-friendly interfaces.

Community workshops and integration with tools like Kentik or CAIDA datasets amplify reach.

Getting Started with MANRS Actions

1. Assess your network via the Observatory.
2. Implement filtering with IRR/RPKI.
3. Deploy SAV (e.g., BCP38).
4. Publish contacts and policies.
5. Join MANRS for peer support.

Resources: MANRS Implementation Guide.

Frequently Asked Questions (FAQ)

Conclusion: Building a Secure Routing Future

The MANRS Observatory transforms abstract threats into actionable intelligence, driving collective progress toward a hijack-resistant Internet. As adoption grows, expect fewer disruptions and greater trust. Network leaders: check your status today and commit to MANRS— the Internet’s security depends on it.