Validating BGP Paths with Cloudflare Radar’s ASPA Tool

by

Introduction

On August 24 2026 Cloudflare announced that its Radar platform now includes an ASPA validation tool in the Routing section. The feature lets operators paste a BGP AS_PATH and instantly see whether the path complies with the Autonomous System Provider Authorization (ASPA) records published in the RPKI.

What is ASPA?

ASPA (Autonomous System Provider Authorization) is a RPKI object that lists the upstream providers an AS is allowed to announce routes to. By checking a path against these records, validators can detect route leaks – situations where a hop does not have a valid provider relationship with the next hop.

How the Radar ASPA validator works

The tool reads the AS_PATH in BGP wire order (right‑most AS is the origin). Numbers can be separated by spaces, commas, or hyphens, with or without the AS prefix. Once the page loads, the full ASPA snapshot is cached in the browser, so each validation is performed locally without additional network requests.

Supported verification algorithms

Two algorithms defined in draft‑ietf‑sidrops‑aspa‑verification are evaluated simultaneously:

  • Upstream – assumes the route was received from a customer, peer, route‑server client, or route‑server. Only an up‑ramp (consecutive customer‑to‑provider hops) is permitted.
  • Downstream – assumes the route was received from a provider. Both an up‑ramp and a down‑ramp (provider‑to‑customer hops) are allowed.

The UI displays the verdict for each algorithm (Valid, Invalid, or Unknown) and highlights hops that fall outside any ramp, which indicates a potential leak.

Interpreting the graph and table

Each hop is marked as Provider+, Not Provider+, or No attestation. A separate table lists every AS in the path, its ASPA status, and the authorized providers, with links to the corresponding Radar AS pages.

Using the tool step‑by‑step

  1. Enter a BGP path in the input box. Example paths are provided to illustrate common cases, including a route leak involving an AS0 ASPA (an AS that declares it has no providers).
  2. Select the desired algorithm mode (upstream or downstream). The graph and trace update automatically.
  3. Review the verdicts. An Invalid result means no chain of provider authorizations covers the entire path, which is the hallmark of a leak.
  4. If needed, share the result. The current path and algorithm are encoded in the URL, so the link reproduces the exact validation when opened by anyone else.

Limitations

The validation follows a draft specification that has not yet become an RFC, so implementations may diverge as the standard evolves. Additionally, the tool only validates against the ASPA records that are currently loaded; any missing or outdated records could affect the outcome.

Conclusion

Cloudflare Radar’s ASPA validator offers a quick, browser‑based way to check BGP paths against provider authorizations, helping network operators identify route leaks without installing separate software. By understanding the upstream/downstream algorithms and the meaning of the graph’s annotations, users can make more informed routing security decisions.