BYOIP ASN Visibility

RPKI tells you the announcement was authorized. It doesn't tell you what the rest of the internet actually sees. ASN Visibility closes that gap: after your prefix is advertised, it tracks the origin ASN observed for the prefix in public routing data and compares it against the origin ASN configured on the customer CIDR.

ASN Visibility is read-only. It never changes the announcement, and a non-Match result doesn't block traffic — it tells you to go look.

What ASN Visibility Shows

For each BYOIP prefix, the console shows an ASN Visibility result built from three things:

Input	Where it comes from
The prefix queried	A BYOIP prefix is queried by its actual prefix — the CIDR you brought in
The observed origin ASN	Read from RIPE public routing data, in real time
The expected origin ASN	The origin ASN currently configured on the customer CIDR

The result is the comparison between the last two.

Results

Result	What the console shows	What it means
Match	Your origin ASN alone — for example RIPE 62610	The prefix is originating from your ASN, and from nothing else.
MOAS	Your origin ASN plus at least one other, with the unexpected one flagged — RIPE 62610 12345	Multiple Origin AS: the prefix is being originated by more than one ASN at the same time.
Mismatch	An ASN that isn't yours — RIPE 12345 — or no origin at all — RIPE -	The prefix is not observed originating from your ASN: either another ASN owns the origin, or nothing is visible yet.

Reading a Non-Match Result

MOAS. More than one ASN is originating the prefix. That is not automatically a hijack — the usual cause is a stale announcement of the same prefix from a network you're migrating away from, or an upstream that is still originating it on your behalf. Work through the sources you control first: confirm the prefix has been withdrawn everywhere except Zenlayer, then check whether an upstream is re-originating it. If neither explains the extra ASN, treat it as a possible hijack and escalate to the network that owns it, with your ROA as evidence.

Mismatch, with a different ASN. The prefix is visible, but the origin isn't yours. Check the origin ASN on the customer CIDR first — if it was recently updated, the observation may still reflect the previous ASN. If the CIDR is correct and the observed ASN is one you don't recognize, this is the stronger hijack signal of the two results.

Mismatch, with no origin observed (-). No origin was seen for the prefix. Right after a create or an origin-ASN update, this usually means routing data hasn't caught up yet — check again shortly. If it persists, the prefix isn't propagating: verify the customer CIDR reached Active, and see Best Practices.

ASN Visibility and RPKI

The two checks sit on opposite sides of the announcement and answer different questions:

• RPKI is a gate, evaluated before the prefix is accepted. It answers whether the (prefix, origin ASN) pair is authorized. See Origin ASN and RPKI.

• ASN Visibility is an observation, running after the prefix is advertised. It answers what the internet reports as the origin.

A prefix can pass RPKI and still show MOAS or Mismatch — authorization doesn't stop another network from originating the same prefix.

Scope

• BYOIP prefixes are supported, queried by their actual prefix.

• IPv4 and IPv6 from IP Leasing are not yet supported by ASN Visibility.

---

Frequently Asked Questions

I just created the CIDR and ASN Visibility shows no origin. Is something wrong? Probably not. Routing data reflects the announcement only once it has propagated. Check again shortly; if the result doesn't settle and the CIDR is Active, open a case with support.

Does a MOAS or Mismatch result stop my traffic? No. ASN Visibility only reports what it observes. Reachability depends on the announcement and on downstream routing policy — including RPKI enforcement, which drops routes whose origin the ROA doesn't authorize.

I updated the origin ASN. How long until the result reflects it? Until the new origin propagates into public routing data. During that window a Mismatch against the previous ASN is expected.

Does ASN Visibility replace a looking glass? No. It answers one question — which ASN is observed originating your prefix — and it answers it continuously. Path-level questions still need a looking glass.

Why isn't the leased IPv4 / IPv6 I got from Zenlayer covered? ASN Visibility does not yet support addresses from IP Leasing. Only BYOIP prefixes are queried today.