PERSONAL.EXE / CASE FILE / EDUCATION

ROV: one prefix, three outcomes

A synthetic demonstration of Valid, Invalid and NotFound states under RFC 6811.

Synthetic teaching example. No live measurements or investigations.

OFFLINE LAB / DEMO
01

Question

What determines whether a BGP announcement origin is authorized?

02

Context

The teaching model uses documentation IPv4 prefixes, sample AS numbers and pre-supplied VRPs. It does not use live Internet routing data.

03

Methodology

  1. Use announcement 203.0.113.0/24 from AS64500 and a matching authorized VRP.
  2. Keep the same VRP but change origin AS to AS64599.
  3. Use 192.0.2.0/24 with no covering VRP.
  4. Apply RFC 6811 rules offline without network scanning.
04

Tools

  1. Deterministic model in lib/personal/rov-demo.ts; no BGP connection.
  2. Synthetic VRPs assumed already cryptographically validated.
05
06

Observations

  1. AS64500 with a matching VRP → Valid.
  2. AS64599 covered by a VRP for a different AS → Invalid.
  3. 192.0.2.0/24 with no covering VRP → NotFound.
07

Interpretation

ROV evaluates whether the origin AS is authorized for the prefix and maxLength; it does not validate the entire path. NotFound does not mean Invalid.

08

Limitations

This simplified model covers IPv4 and already validated VRPs. It does not verify ROA signatures, live BGP updates, RPKI caches or router policy. It is a simulation, not a network measurement.

09

Conclusion

The synthetic examples illustrate the three defined ROV states. This is not certification, penetration testing or evidence of operational security.