Cloudflare Radar Ships an ASPA Tool to Spot Shady BGP Routes!

Hey everyone, it's Shii-chan! Today I've got a nerdy-but-handy story about a tool that lets you check BGP routes right in your browser.

Cloudflare Changelog developers.cloudflare.com

What was announced?

This comes from Cloudflare's Changelog. Cloudflare Radar's Routing section just got a new ASPA validation tool. You enter a BGP AS_PATH (the sequence of AS numbers a route traveled through), and it checks that path against the Autonomous System Provider Authorization (ASPA) records published in the RPKI to tell you whether the route looks legitimate.

The tool returns one of three verdicts:

• Valid — the whole path is covered by a chain of provider authorizations
• Invalid — part of the path isn't covered, which is the signature of a route leak
• Unknown — there isn't enough information to decide

Validation follows the draft-ietf-sidrops-aspa-verification IETF draft, which is still a work in progress and not yet an RFC.

Why it matters

BGP is the core mechanism that decides how traffic flows across the internet, but misconfigurations or bad route announcements can cause route leaks, where traffic ends up flowing through paths it was never supposed to take. That can slow things down, or in the worst case open the door to interception or disruption.

ASPA lets each autonomous system declare its legitimate upstream providers, so anyone can check whether a path actually travels through that authorized chain. Until now, doing that check meant reading the spec closely and building your own validation logic, or reaching for a dedicated tool. Now it's just a few clicks away inside Radar.

What changes

When a network engineer wants to double-check whether an AS_PATH is legitimate, they can now just paste it into Radar and get a Valid / Invalid / Unknown verdict along with a visual graph, no custom tooling required. Investigating a suspected route leak, or confirming that your AS's provider relationships are correctly reflected in ASPA, just got a lot easier.

Dive Deep

You can pick between two verification algorithms depending on which direction you're checking the path from:

• Upstream — for routes received from a customer, peer, or route server client. Only an up-ramp (moving toward providers) is allowed
• Downstream — for routes received from a provider. Both an up-ramp and a down-ramp (moving toward customers) are allowed

Paths are read in BGP wire order, where the rightmost AS is the origin and the leftmost AS is closest to the observing router. You can separate AS numbers with spaces, commas, or hyphens, with or without an AS prefix.

Results show up as an ASPA validation graph that draws the path hop by hop, marking each hop as Provider+, Not Provider+, or No attestation. The full ASPA snapshot loads into your browser once, so as you edit the path, the verdict and graph update instantly with no extra network requests.

A set of example paths is included too, covering cases like a route leak involving an AS0 ASPA — an AS declaring it has no providers at all — so you can get a feel for how the verdicts work.

Wrap-up

• Cloudflare Radar's Routing section now includes an ASPA path validation tool
• Enter an AS_PATH to get a Valid / Invalid / Unknown verdict on possible route leaks
• Validation follows the in-progress draft-ietf-sidrops-aspa-verification IETF draft
• Choose between Upstream and Downstream verification algorithms
• A hop-by-hop graph and example paths make the verdict logic easy to follow

If you work with BGP or RPKI, or you need to investigate a route leak, this tool is worth bookmarking.