Md.Kamruzzaman Khan

“Thanks for writing this up. Signal 2, especially the evidence around the straggler prefixes, is a rare operational detail and one of the most valuable parts of the article. A few thoughts came to mind while reading. First, the resilience section may contain another useful signal. If the prefixes that disappeared from RIS were still being advertised or remained reachable through BDIX, that would point to a selective loss of international routing rather than a general network failure. The BDIX traffic graph alone cannot prove this, since a failure or shutdown at the IIG or transit edge could leave domestic peering untouched. Still, the idea may be testable. If BDIX retains route-server logs or snapshots, a prefix-by-prefix comparison could show whether routes remained visible domestically while disappearing from international collectors. Bilateral sessions would not necessarily appear there, but even partial evidence would strengthen the analysis. Second, I think the routing-security section needs a small correction. ROV enforcement at the IXP would not have made these withdrawals cryptographically auditable. RPKI validates the origin of route announcements; it does not sign or authenticate withdrawals. Even BGPsec protects the announcement path, not the later removal of a route. A route server may of course log that a prefix disappeared, but ROV adds no cryptographic attribution to that event. The recommendation that IXPs and transit providers should state whether they enforce ROV is still a good one, but I would keep it separate from the events of 18 July. Third, the eight-hour limitation belongs to the RIPEstat view or endpoint used in the analysis, not to RIS itself. RIS also archives the updates received by its collectors in five-minute MRT files. The July 2024 events can therefore be reconstructed retrospectively without RIS Live and with much finer timing. This could show whether operators placed in the same eight-hour bucket actually withdrew minutes or several hours apart, and clarify how long the IPv6 stragglers remained visible. The MRT timestamp still records when an update was observed by a collector peer, not the exact moment a command was entered, but it would remove much of the ambiguity. I would be very interested to see a follow-up based on the raw MRT data. The combination of public collector data and direct operational experience is what makes this analysis particularly valuable. Thanks -- antonio”

Antonio, Thanks for this. One of the three I can close now, one I can only half close, and one you have given me a way to test. On BDIX, the part I can settle is the alternative you raise. For AS63526 the loss of international routing originated at the AS itself — my own account as the operator, not something the collector view can show — not at an IIG or transit edge failing underneath while domestic peering stayed up. So for at least one network the selective reading holds, on operational grounds rather than on the traffic graph. What I cannot settle is which of those prefixes stayed reachable domestically at the same moment, and the section should not have rested that on the graph. Your caveat about bilateral sessions is the binding constraint here rather than a footnote. Because a share of the peering at this exchange never touches the route servers, a prefix-by-prefix comparison would establish a lower bound on domestic visibility rather than measure it: presence in the logs is evidence, absence is not. That still helps, but it bounds how much the comparison can carry. I am asking what survives from that week, and will run the comparison if anything does. On ROV, the distinction you draw is the one the section missed. A route server can log that a prefix disappeared, but nothing in the deployed stack attests to the disappearance. The nearest thing in progress is the Signed Prefix List work, which makes absence checkable against a declared complete set, but that is a statement about what an AS may originate rather than an authenticated record that a route was removed at a given time. RFC 8205 is explicit about this at the edge of its own threat model: withdrawal suppression is left outside the protocol and deferred to certificate rollover. So the gap is architectural rather than a matter of deployment. Agreed that the recommendation should stand apart from 18 July. On the eight hours, one refinement: the interval is RIS's own per-collector RIB dump cadence surfaced through RIPEstat, rather than something RIPEstat introduces. Your point is unaffected, since the update files are the finer source either way, and I queried the wrong one. Your caveat about MRT timestamps is the real limit on what the timing analysis can claim, and I would rather be explicit about it than work around it. For AS63526 I can say which withdrawals were initiated at the AS rather than inferred from the collector view, which narrows the ambiguity for one network, but that is operator testimony and not a measured offset, and I will label it as such. Where the write-up gives times, they will be collector observations, and I will say so each time rather than let the two blur. You singled out the straggler prefixes, and that is where I will start, since it is the part I would most like to put on firmer footing. I would value your eye on it when it is ready. Kamruzzaman 1 Aug,2026