Verify an AS path with ASPA
check_aspa_pathCheck an AS_PATH against the published ASPA objects (RPKI attestations of which providers a network authorises), following the verification procedure of draft-ietf-sidrops-aspa-verification. The result is valid, invalid or unknown, with the reason and the first hop that broke the path.
Use it to find out whether a path shows a route leak or an unauthorised provider. "Unknown" only means some network on the path published no ASPA; it is not a fault.
Behavior: offline, answered from the local RPKI snapshot. The procedure is an Internet-Draft, not an RFC, and the neighbor-AS and AS_SET prerequisite checks of a real router are left out. Only the path is read; it is neither stored nor logged.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | the AS_PATH as seen by the receiver, neighbor first and origin last, separated by spaces or commas, e.g. 3356 1299 14041 194 (every hop is an AS number, with or without the AS prefix). Prepending is fine; an AS_SET {..} is refused | |
| direction | No | upstream (default): the route came from a customer or peer; downstream: it came from a provider |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | the path after removing repeated ASes, neighbor first | |
| reason | No | ||
| outcome | Yes | valid, invalid or unknown (no attestation for some hop). Informational; follows an Internet-Draft, not an RFC | |
| summary | Yes | the human-readable result, the same text as the text content | |
| direction | Yes | ||
| aspa_count | No | number of ASes with an ASPA in the loaded set |