AS-SETs and expansion

An as-set groups ASNs. Its usual job is to describe a customer cone: a network plus everything it provides transit for. When AS64500 tells its upstream "build my filter from AS64500:AS-CUSTOMERS", the upstream expands that set to ASNs, then collects every route object those ASNs originate.

Members

• members: lists ASNs and other as-sets, so sets nest. A transit's set includes each customer's set, which includes their customers' sets, and so on.
• mbrs-by-ref: lets members join from their own side: any aut-num with member-of: <this set> is included, if it is maintained by a maintainer listed in mbrs-by-ref (or the list is ANY).

Naming

• Flat names like AS-EXAMPLE are a single global namespace across every IRR source. Two unrelated networks can create AS-EXAMPLE in RADb and in RIPE, and tools may merge or confuse them.
• Hierarchical names like AS64500:AS-CUSTOMERS start with the owner's ASN. In an authoritative IRR, only the holder of AS64500 can create sets under that prefix. Prefer hierarchical names.

Expansion is where things go wrong

Expansion is recursive, so a single bad member pulls in everything below it:

• Set bloat: a customer adds their upstream's set (or a large IXP's) to their own. Expanding it now yields thousands of ASNs, and your "customer filter" accepts much of the internet.
• Loops: set A includes B, and B includes A. Good tools detect this and stop.
• Stale members: a customer that left years ago is still in the set, along with its route objects.

Try it below.

as-set:         AS64500:AS-CUSTOMERS
descr:          AS64500 and its customer cone
members:        AS64500
members:        AS64501:AS-CUSTOMERS
mbrs-by-ref:    EXAMPLE-MNT
admin-c:        EX123-RIPE
tech-c:         EX123-RIPE
mnt-by:         EXAMPLE-MNT
source:         RIPE