What is counted
The tracker counts what the global RPKI tree published at the moment of each observation. Every number is a count of published objects, not a routing outcome:
- ROA objects: one published Route Origin Authorization record (prefix, max length, origin ASN). Objects are not deduplicated across TAs, so the same prefix-origin pair published in two RIRs' repositories counts twice — the same way the source presents it.
- ROA-holding ASNs: distinct origin ASNs across all ROA objects. One ASN can hold thousands of objects, so this number moves slowly and measures breadth of deployment.
- ASPA records: one published Autonomous System Provider Authorization per customer ASN (provider sets are not expanded).
- Address family: ROA objects whose prefix is IPv4 or IPv6.
- BGPsec keys, signed prefix lists, certificates, TALs: counts as published in the source snapshot.
Source and cadence
Each observation is one fetch of the Cloudflare RPKI portal JSON export (an rpki-client run over the five RIR trust anchors), stored as a self-contained snapshot by the BGPKIT RPKI tracking pipeline. Observations are scheduled weekly (Mondays) and were collected at an irregular cadence before 2026-09-14; the trend charts plot each observation at its own timestamp, so a visible gap is a collection gap, not missing RPKI data. Snapshot times are shown in UTC.
Windows and deltas
Each report compares one observation against the observation nearest to seven days earlier. When collection gaps make that impossible the nearest earlier observation is used and the actual measured window is printed on the report (for example, the 2026-09-14 report used a 45.5-day window against 2026-07-31). A delta therefore always states its own window; nothing here assumes an evenly spaced series. The same numbers feed the BGPKIT weekly RPKI briefing, so the page and the briefing agree by construction.
Country and region attribution
Countries and continents are not part of the RPKI objects. They come from ASN registry data (RIR delegated statistics and ASN name files) matched on the origin ASN of each ROA or the customer ASN of each ASPA. Limits:
- Unknown (XX) aggregates ASNs with no usable country record in any source. The attribution card splits them into AS0 ROAs, private/reserved/documentation ASN ranges, allocated ASNs with no country on record, and ASNs absent from every source.
- The country of the ASN is not always the country where the RPKI object is managed, and RIR-based attribution of a region is an ASN-registry property, not a routing or business fact.
- ASPA attribution coverage was added to the pipeline on 2026-09-14; older observations carry no attribution block.
What this cannot establish
- Validation is out of scope. The tracker never sees BGP announcements, so it cannot say whether any prefix is Valid, Invalid or NotFound for a given network.
- Counts can move without deployment changing. Re-issued certificates, dropped or added objects in a repository, and TA reprocessing all shift object counts; a small weekly delta is usually re-publication churn, not a policy change.
- One source, one run. The upstream export is a single global run; a partial or failed run upstream would appear here as a step change. Cross-checks against a second vantage are not part of this pipeline.
- No operator intent. Nothing here is a statement about an operator's, region's or RIR's intent or performance; it is an observation of published objects.
Reproducibility
Every report is downloadable as JSON (index and series;
/live/reports/YYYY-MM-DD.json per observation, linked from the report history table) and carries its
source metadata, snapshot timestamps and measured window. The pipeline runs on BGPKIT infrastructure from the
same snapshots that produce the weekly briefing.