What is IRR?

An IRR (Internet Routing Registry) is a public database where networks publish which IP prefixes they announce in BGP and, optionally, their routing policy.

The data is written in RPSL, the Routing Policy Specification Language. The key objects are route and route6, which pair a prefix with the AS number allowed to originate it, aut-num, which describes an autonomous system and its policy, and as-set, which groups AS numbers, for example "my network plus all my customers". Registries come in two kinds. Those run by the regional registries, such as the RIPE Database, ARIN and APNIC, are authoritative for the address space they manage, so creating a route object requires the holder of that space to agree. Others, such as RADb, accept registrations from paying members with weaker checks, and they mirror one another. You query them with whois, and objects are protected by a mntner that controls who can change them.

The main practical use is building inbound prefix filters. When a customer or peer connects, their provider expands the customer's AS-SET to a list of AS numbers, finds every route object those ASes originate, and turns the result into a prefix list with a tool such as bgpq4. The weakness is that much IRR data is stale, and in the non-authoritative registries anyone can register a route object for space they don't hold, so an attacker can sometimes create the very entries a filter trusts. That is one reason networks combine IRR filtering with RPKI, whose ROAs are cryptographically signed by the address holder. If a new prefix of yours is being dropped by an upstream, a missing or wrong route object is a common cause. The IRR, RPSL and AS-SETs lesson works through real whois queries and filter generation.