What is NRTM?

NRTM (Near Real Time Mirroring) is the protocol Internet Routing Registries use to stream changes to each other, keeping mirrors up to date.

Routing data is spread across many IRR databases: the five RIRs each run one, and others such as RADb and those of large operators hold objects too. Tools that build filters prefer to query a single server that holds all of them, so registries mirror one another. A new mirror first loads a full export of the source database, which states the serial number it is current to. It then connects to the source's NRTM service and asks for every change after that serial. The source replies with a journal of numbered ADD and DEL operations, each carrying a complete RPSL object such as a route or aut-num, and the mirror applies them in order and repeats the request every few minutes. The long-standing version, NRTMv3, runs over the same plain-text whois protocol on TCP port 43. A newer version, NRTMv4, moves to files fetched over HTTPS with signatures, so mirrors can verify that the data came from the source.

You rarely use NRTM directly, but it explains behaviour you will see. A newly created route object may take a little while to appear on a mirror such as RADb. A mirror that has lost its NRTM feed can quietly serve stale objects, which is one way outdated or deleted data ends up in filters. And NRTMv3 has no authentication of the data in transit, so a mirror is only as trustworthy as its connection to the source. IRRd, the software behind many registries, implements both sides of the protocol. The IRR, RPSL and AS-SETs lesson covers how registries, IRR objects and mirrors fit together.