MANRS Routing Security: 3 Programs Protecting BGP Resilience

The Internet’s backbone relies on the Border Gateway Protocol (BGP) to direct data traffic worldwide. However, BGP’s vulnerabilities to hijacks, leaks, and spoofing pose significant risks to global connectivity. Mutually Agreed Norms for Routing Security (MANRS) addresses these challenges by promoting voluntary standards among network operators, Internet exchange points (IXPs), and others. This article delves into MANRS’s evolution, key milestones, participant growth, conformance challenges, and future implications for a more secure digital ecosystem.

Understanding the Foundations of MANRS

MANRS emerged as a collaborative effort to mitigate BGP-related threats. It outlines specific actions for participants, including filtering invalid routes, preventing source address spoofing, facilitating global coordination during incidents, and maintaining accurate route origin data. These norms are not mandates but incentives for operators to enhance practices, reducing the likelihood of widespread disruptions.

Initially launched with a small group of operators, MANRS has expanded into multiple programs: one for network operators, another for IXPs, and additional categories for content delivery networks (CDNs) and data centers. This modular approach allows diverse stakeholders to contribute based on their roles in the routing ecosystem.

Key Milestones in Participant Growth

One of the most notable achievements came in late 2018 when MANRS surpassed 100 network operator participants. This milestone, reached on October 17 with Magticom as the 100th member, represented a doubling of engagement that year alone, with over 50 new joiners. By December 2018, the total stood at 114 participants, including 26 IXPs committed to the newly launched IXP program in April.

• Network Operators: Commit to core actions like route filtering and anti-spoofing.
• IXPs: Prevent propagation of bad routes and promote MANRS among members.

Fast-forward to 2022, MANRS reported 886 participants across its programs, adding 136 that year. This surge underscores growing recognition of routing security’s importance amid rising incidents.

Expanding Programs: The Role of IXPs and Beyond

The IXP program, introduced in 2018, marked a pivotal expansion. IXPs, critical hubs for peering traffic, agree to protect platforms from invalid announcements, enable operational communication, and offer monitoring tools. By 2018’s end, 26 IXPs had joined, amplifying MANRS’s reach.

Recent developments include integrations like the Network Security Special Interest Group (NetSec SIG) approved by FIRST in August of an earlier year, fostering deeper community collaboration. Programs now extend to CDNs and hosting providers, tailoring actions to their unique contributions.

Measuring Conformance and Real-World Impact

While participation numbers impress, conformance is crucial. A 2023 APNIC study analyzed 931 MANRS ASes up to November 2022, finding 84.9% (790) adhered to Action #1 (prefix origin validation via RPKI/IRR). However, 15.1% showed issues, though not all affected address space was invalid.

From 2015-2022, MANRS ASes originated an additional 12.1% of IPv4 space, signaling broader coverage. Yet, challenges persist: route leaks comprised 24.43% of observations in some datasets, with hijacks at 15.38%. Discrepancies between tools like BGPStream and MANRS Observatory highlight monitoring complexities.

Participation growth reflects industry momentum, but sustained conformance requires ongoing validation and incentives.

Tackling Persistent Threats: Leaks and Hijacks

Routing incidents underscore MANRS’s urgency. Summer periods have seen spikes in leaks degrading connectivity. Operators face incentives misalignments, but MANRS promotes best practices like RPKI Route Origin Validation (ROV), reaching major milestones recently.

U.S. efforts, including policy pushes for better routing, align with global MANRS adoption. Enterprise customers are advised to prioritize MANRS-participating ISPs, influencing markets like Europe where options vary by region.

Future Directions for MANRS and Routing Security

Looking ahead, MANRS aims for broader adoption, enhanced tools, and integration with standards like RPKI. Community reports emphasize validation, education, and incident response. With 886 participants by 2022, covering significant Internet topology, MANRS fortifies resilience against evolving threats.

Challenges include non-participant regions and conformance gaps, but momentum builds. Encouraging IXP and CDN involvement will further secure peering and content delivery.

Frequently Asked Questions (FAQs)

What is MANRS?

MANRS is a voluntary initiative promoting routing security norms to prevent BGP hijacks, leaks, and spoofing.

How many organizations participate in MANRS?

As of 2022, over 886 across programs, up from 114 in 2018.

Why do IXPs matter in MANRS?

IXPs filter bad routes at peering points, preventing widespread propagation.

Is MANRS mandatory?

No, it’s voluntary, relying on community commitment and peer pressure.

How does RPKI fit into MANRS?

RPKI enables cryptographically validating route origins, a key conformance metric.

Conclusion: Building a Resilient Internet

MANRS’s trajectory from a niche effort to a cornerstone of routing security demonstrates collective action’s power. As threats evolve, continued growth, conformance focus, and innovation will safeguard the Internet for billions. Network leaders should join, validate practices, and advocate for widespread adoption.