MANRS (Mutually Agreed Norms for Routing Security)

A community agreement on baseline routing hygiene: filter announcements from your customers, prevent traffic with spoofed source addresses from leaving your network, keep your public routing data accurate, and coordinate with other operators.

It is not a standard or a protocol but a published set of commitments with a participant list, which makes it a reputational instrument as much as a technical one. That is the point - most routing incidents are caused by an operator not doing one of four unglamorous things, and no protocol change can force them. When a network is asked why it accepted an impossible announcement, the answer is almost always that nobody had made filtering someone's explicit job.

MANRS describes itself as a global initiative, supported by the Global Cyber Alliance and partially funded by a five-year grant from the Internet Society. For network operators its normative text is the actions document MANRS-003.01 (17 May 2021), whose scope is incorrect routing information, traffic with spoofed source addresses, and coordination between networks.

The document grades its actions. Compulsory: announce to adjacent networks only the AS numbers and prefixes the operator or its customers are legitimately authorised to originate; keep contact data current in the RIR or NIR database or PeeringDB; and publicly document intended announcements in the RIR's routing registry, RADB or an RADB-mirrored Internet Routing Registry (IRR). Recommended: source address validation for its own infrastructure, end users and single-homed stub customers, and a valid ROA for each prefix it originates. Anti-spoofing, which the About page lists among the actions without grading them, is a recommendation in the normative text.

The document also warns that filtering customer announcements by AS-path filters alone is insufficient to prevent catastrophic routing problems at a systemic level. After the Verizon and DQE leak of 24 June 2019, Cloudflare wrote that its suggested defences, prefix limits, IRR filtering and RPKI, were condensed into MANRS.

Also known as: routing security norms, prefix filtering, anti-spoofing

Sources

← All glossary entries