RIPE 92 took place in Edinburgh, Scotland, bringing together ISPs, network operators, registries, and engineers for a week of working groups, plenaries, and a lot of hallway discussions.
From FastNetMon, Outi Pietilanaho attended, splitting time between sessions and the usual RIPE meeting rhythm: talks, coffees, and meetings with friends and partners. of FastNetMon.
Our plenary highlights
The plenary agenda was packed, as usual, a mix of operational updates, research, and security talks. Here are a few sessions that stood out to us, mainly because they were directly DDoS-related or touched on real-world routing security and attack infrastructure in a way that’s relevant to our community.
What DDoS scrubbing looks like in BGP data
One of the more curious pieces of work came from Shyam Krishna Khadka from the University of Twente, who analysed DDoS scrubbing behaviour using global BGP data across major mitigation providers.
The focus was on how scrubbing centres show up in AS paths during mitigation events, and how that differs between always-on protection and on-demand activation. The dataset also included measurements around how long scrubbing sessions typically last and how consistently traffic is steered through mitigation infrastructure.
Worth following this line of work further as it develops.
What the terabit-scale DDoS looks like in today's environment
A strong operational security talk came from Jérôme Meyer from Nokia, who gave a very grounded view of current DDoS traffic sources and botnet ecosystems.
The key point: a lot of today’s attack traffic is not coming from “classic IoT botnets” anymore. It’s a mix of residential proxy networks, consumer devices with proxy SDKs, and large-scale distributed fleets that are effectively monetised as bandwidth infrastructure.
From an operator point of view, this is what matters: attack traffic is increasingly indistinguishable from “normal-looking” residential or subscriber-originated flows, it just happens at a massive at scale.
Routing security: trust boundaries and deployment reality
Two talks in the opening plenary highlighted different sides of the same underlying theme: how routing security is increasingly shaped by implementation details and operational reality rather than just protocol design.
Sasha Romijn (Reliably Coded, IRRD / IRRexplorer / internet.nl) presented their work on how seemingly harmless data fields across infrastructure systems, from TLS certificates and DNS responses to RIPE database objects, can become a security issue when rendered or processed without strict trust boundaries. The talk turned slightly provocative (in a positive way!), exploring how these flows can propagate into sensitive systems such as RPKI-related workflows, depending on how tooling and authentication layers are implemented.
Maria Matejka (BIRD / CZ.NIC) gave an update on ASPA and why it remains in draft despite being close to feature-complete. The focus was on deployment friction: integrating AS path validation into real-world routing policy systems, and the operational considerations that slow adoption more than the protocol itself.
Working groups, policy, and operational updates
Beyond security topics, the usual RIPE working group structure was there: address policy, routing, DNS, operational updates, and the steady flow of operator input that keeps the system aligned.
It’s still one of the few places where protocol designers, registry people, and day-to-day network operators are in the same room debating about how things should work.
RIPE 92 socials: The Dome, Dynamic Earth, and Edinburgh after-hours
The main social was on Tuesday at The Dome of Edinburgh. A Category A listed building from 1847, originally the Commercial Bank of Scotland headquarters, with a heavy Graeco-Roman frontage and a domed interior that does most of the visual work. Good space for a few casual drinks and chats before turning it into a dancefloor.
The Thursday dinner took place at Dynamic Earth, Edinburgh, at the base of Salisbury Crags. A modern contrast — glass-and-steel science centre built around geological history. We didn’t make it into the exhibition, but the venue itself was strong enough to carry the evening.
Between organised events, the usual RIPE pattern filled the gaps: informal catch-ups across Edinburgh pubs, continuing off-agenda, and the standard mix of reconnecting with people you only see a few times a year. And with a packed week, the FastNetMon delegation once again missed the famous whisky BoF, second time running.
Thank you, RIPE NCC & Edinburgh!
As the event closes, we want to thank the RIPE NCC team for running RIPE 92 smoothly and keeping everything on track throughout the week.
It was a productive and pleasant RIPE meeting overall, with plenty of useful conversations and familiar faces.
Looking forward to seeing everyone again at RIPE 93 in Sofia.
