Monitoring AS-SETs and why they matter

AS-SETs are IRR objects that let network operators group related networks, with Cloudflare using AS13335:AS-CLOUDFLARE to collate its own ASNs and BYOIP customer networks for routing communications. They remain a trust-based, best-effort mechanism, and the article highlights the push toward a more formal authorisation system like ASPA and, according to RFC9234, an in-protocol OTC approach to detect and prevent route leaks.

The piece explains how AS-SETs, often used with RPSL, underpin BGP route filtering and how tools such as bgpq4 can generate prefix-lists from AS-SET and IRR data. A concrete example shows AS64503 enforcing an import policy that only accepts prefixes from the AS Cone of AS64502, stopping a potential leak that could have affected many prefixes.

Cloudflare Radar now publicly lists IRR AS-SET information, including how many AS members and AS-SET members exist, and provides a tree-view to show how an AS-SET includes a given ASN, with the aim of encouraging operators to monitor for misuse and keep memberships accurate.