Martians, Bogons, and RPKI Invalids: Why Organizations Should Filter Them

An announcement classified as RPKI Invalid is different: the prefix exists and has been allocated, and the originating ASN also exists. However, the BGP announcement does not match the authorization published by the resource holder through RPKI in a Route Origin Authorization (ROA). This may be caused by an error when creating the ROA or by an attempted route hijack. In July 2026, the MANRS Observatory detected more than 4,200 invalid prefixes on the Internet.

Example:

These concepts may sound theoretical, but they are observed on the Internet every day and are responsible for thousands of operational incidents every year.

Incidents

A detailed LACNIC study examining routing incidents between October 2023 and October 2024 identified more than 300 bogon announcements in Latin America and the Caribbean. Far from being a problem of the past, bogons continue to appear regularly. During the first half of 2026, the MANRS Observatory identified more than 800 incidents related to this type of announcement.

A bogon route can send traffic toward unreachable destinations, divert traffic from its intended path, disrupt network operations, and create opportunities for malicious activity. Its presence is often a sign of configuration errors or inadequate routing hygiene.

RIRs and Their Reserved Prefixes

RIRs do not directly publish a list of bogons. Instead, they periodically publish information on delegated, allocated, reserved, and available resources. These data can be used to identify prefixes that have not yet been delegated or assigned and that, therefore, should not appear in the global routing table. Tools such as Team Cymru Fullbogons build dynamic lists from this information and make them available to the community.

AS0 ROAs are also being used by some RIRs as a mechanism to protect resources that must not be originated on the Internet. LACNIC and APNIC publish resources protected through AS0 within their respective RPKI infrastructures.

AFRINIC has also adopted a policy governing the use of AS0 for unallocated resources. The policy was ratified in 2022 but, at the time of writing, had not yet been implemented.

Operational Best Practices

Filtering unwanted BGP prefixes can be challenging because the underlying datasets change constantly. Filtering should therefore be applied in both directions: inbound and outbound. Inbound filtering prevents martians, unallocated address space, and RPKI-invalid routes from entering the network through transit providers, peers, or customers. Outbound filtering prevents internal configuration errors—or errors originating in customer networks—from being propagated to the rest of the Internet.

Both are equally important: inbound filters protect the organization’s infrastructure, while outbound filters protect the rest of the Internet from errors originating internally or in customer networks.

When a bogon, an RPKI-invalid route, or another incident is detected, promptly contacting the responsible operator helps accelerate its resolution. Contact information in WHOIS and IRR should therefore be kept up to date, the information published in PeeringDB should be verified, and published email addresses should be actively monitored. Many incidents are resolved within minutes when the communication channel is clear.

Five Basic Recommendations

The following are basic recommendations for protecting the network from improper prefixes:

1. Statically filter martian prefixes using IANA’s special-purpose address registries, and apply filters to announcements received from customers and peers, allowing only authorized prefixes.

2. Use RPKI validation—for example, with FORT—to filter RPKI Invalid announcements and prefixes covered by AS0 ROAs.

3. Optionally, use services such as Team Cymru Fullbogons to receive dynamic updates on bogon prefixes and automate their filtering.

4. Keep contact information in WHOIS, IRR, and PeeringDB up to date and validate it periodically.

5. Participate in the MANRS initiative and use its Observatory to monitor the security and compliance status of the organization’s ASNs.

Conclusion

Bogons and RPKI-invalid routes continue to appear in global routing tables every day. Although most of these incidents are caused by operational mistakes rather than deliberate attacks, their impact can extend far beyond the network in which they originate.

Prefix filtering, RPKI origin validation, AS0 ROAs, and reliable, up-to-date bogon data are relatively straightforward measures that can substantially improve global routing hygiene. A prefix that should never be propagated on the Internet should never be advertised in the first place.

Whether the problematic route is a bogon or an RPKI-invalid announcement, the most effective way to prevent an incident is to stop the route from propagating at its source.