What is VRP?

A VRP (Validated ROA Payload) is a (prefix, maxLength, origin AS) entry that an RPKI validator extracts from a ROA after verifying its signatures.

Address holders publish ROAs in the RPKI to say which AS may originate their prefixes. Routers don't fetch or check these signed objects themselves. Instead, a validator such as Routinator, rpki-client or FORT downloads the repositories, verifies every certificate and signature back to the trust anchors, and discards anything invalid or expired. What remains is reduced to a plain list of VRPs, for example "198.51.100.0/24, maxLength 24, AS64500". A ROA covering several prefixes produces one VRP for each, so the VRP list is the working form of the RPKI. The validator sends it to routers over the RTR protocol and refreshes it as ROAs change.

Routers use VRPs for ROV. A route is Valid if a VRP covers its prefix with a matching origin AS and the prefix is no longer than the maxLength, Invalid if VRPs cover it but none match, and NotFound if no VRP covers it at all. The maxLength is a frequent source of trouble: a ROA for a /22 with maxLength 22 makes your own /24 announcements Invalid, while a generous maxLength lets an attacker announce a more-specific prefix with your AS as a forged origin. A VRP with origin AS0 says the prefix should never be announced. When routes are unexpectedly Invalid or NotFound, checking what VRPs the router has actually received, and whether its validators are connected, is the first step. The RPKI and Route Origin Validation lesson feeds a known set of VRPs to a real FRR router and shows each validation state.