August 17, 2026
A MANRS checklist a small ASN can actually finish
MANRS is a short list of things networks should have been doing before it had a logo: do not accept garbage, do not originate garbage, and be reachable when you do. A small ASN can finish it. A large ASN can also finish it and still leak on a Friday. The checklist is the same.
I start with ROAs for every prefix we announce, then an IRR lookup that matches those ROAs, then prefix-lists on customers. The RPKI validator is how I confirm a new origin before I bless it. manrs.org is the official wording; this is the version that fits on one page.
The MANRS list I keep on the wall
- ROA for every production prefix. maxLength as tight as the TE you actually do.
- IRR route/route6 objects that agree with the ROA. Stale AS-SETs deleted.
- Customer filters built from IRR + RPKI, not from “they asked nicely.”
- uRPF or equivalent so you do not forward spoofed source addresses.
- A peering and abuse contact that a human reads. Test it quarterly.
If you cannot name the person who updates the ROA, you do not have RPKI. You have a story.
What MANRS will not save you from
A transit that still accepts invalids. A peer who leaks you. A hijack of space you never signed. Watch the prefixes with a looking glass and, if you announce money, with BGP monitoring. The checklist is hygiene. Hygiene is not a SOC.
Do the five items. Then stop buying posters and go look at your customer export.