AS inventory
Italy has 1101 autonomous systems registered with the RIR. Of those, 1068 (97 %) currently announce at least one IPv4 prefix to the global routing table, and 406 (37 %) currently announce at least one IPv6 prefix. That means 38 % of the IPv4-active ASes have followed through and turned on IPv6.
Operators - PA (Provider Aggregatable) holders
PA-holding ASes are LIRs with their own RIR allocation - they are the operators running parts of Italy’s internet (transits, ISPs, content networks with infrastructure of their own). Italy has 906 PA-holding operator ASes registered with the RIR. Of those, 895 (99 %) announce IPv4 today and 323 (36 %) announce IPv6.
End-sites - PI (Provider Independent) holders
PI-holding ASes hold address space directly from the RIR for their own use - typically enterprises, content sites running their own AS for routing diversity, government / academic single-site deployments. They’re not “operators” in the LIR sense, but they show up in BGP and their v6 readiness still matters. Italy has 82 PI-holding end-site ASes. Of those, 80 (98 %) announce IPv4 and 5 (6 %) announce IPv6.
Country totals: 1101 routed ASes / 1068 announce IPv4 / 406 announce IPv6. 109 ASes are unclassified (RIPE inet*num lookup didn’t return a clear status). PA / PI counts above include the “mixed” bucket on the PA side since a mixed AS holds at least one PA prefix and operationally functions as an LIR.
Executive summary
We measure how 406 Italian autonomous systems that announce 889 IPv6 prefix(es) treat ICMPv6 in practice - Echo, Type 2 (Packet Too Big), Time-Exceeded - using three ICMPv6 vantage points and a 12-node global yarrp mesh, plus the MIX-IT route-server BGP table as ground truth. Generated 2026-05-30 13:19 UTC.
Adoption
According to RIPEstat, 406 ASes registered to Italy announce at least one IPv6 prefix to the global routing table, advertising 889 distinct prefixes between them. The 12-vantage-point mesh observed 341 distinct ASes (Italian + foreign transits) and 726 AS-AS adjacencies along paths into Italy.
ICMPv6 behaviour at the destination
Each AS gets a single classification per vantage point by combining the small Echo, the 1500-byte Echo with DF set, traceroute reachability, and a TCP liveness check. Aggregated across all 3 vantage points, the ITA population looks like this:
- open - 188 ASes (46%)
- echo only - 9 ASes (2%)
- all blocked - 3 ASes (1%)
- no ipv6 implementation - 1 ASes (0%)
- transit only unreachable - 170 ASes (42%)
The open bucket means every vantage point received Echo Replies for both small and 1500-byte probes; this is what every ITA network should look like. echo_only means small ping passed but 1500-byte packets did not - usually either a path-MTU constraint downstream of us, or a real ICMPv6 Type 2 (Packet Too Big) filter en route. The two unreachable buckets cover ASes whose AS edge filters all incoming ICMPv6.
Weekly-probe schedule: 206 of ITA’s 612 IPv6-announcing ASes are on a 6-day probe cycle today because they’ve produced a stably-unreachable / no-host result for 14+ consecutive daily runs. Today’s numbers reflect the 406 ASes probed this run; the skipped 206 are re-tested approximately weekly. (Tuneable in scripts/19_update_skip_list.py -- raise STREAK_TO_SKIP to probe more aggressively, lower WEEKLY_PROBE_DAYS to re-test sooner.)
RFC 4890 compliance (active Type 2 test)
RFC 4890 gives operators the option to drop ICMPv6 Echo at the firewall, but says Type 2 (Packet Too Big) must remain permitted end-to-end - otherwise PMTUD is broken and large flows hang silently. We test this directly: for every reachable AS we open an active flow (TCP/53 DNS, TCP/443 TLS, ICMPv6 Echo, or HTTP/80 - whichever applies), forge an ICMPv6 Type 2 with MTU=1280, and observe whether the destination acts on it.
- RFC 4890 ✓ - 170 ASes proven compliant: AS137, AS2597, AS3242, AS3302, AS5392, AS5394
- RFC 4890 ✗ - 26 ASes proven non-compliant (PMTUD will break for users): AS5602, AS20746, AS24796, AS29438, AS39217, AS39729, AS44908, AS47152
- The remaining 175 are unknown - typically because their network blocks Echo entirely (we cannot directly probe Type 2 acceptance from outside) or because the active test was inconclusive on this run.
Active-test method breakdown across all targets: no_echo = 876, honored = 725, not_honored = 176, inconclusive = 11, partial = 9.
MIX-IT peering
The MIX-IT (Milan) currently has 394 peering members reachable via its route servers. Of those, 193 are Italian-registered ASes; the rest are international peers that serve Italian traffic via MIX-IT (common examples: Hurricane Electric, Cloudflare, PCH).
Top MIX-IT-internal transit relationships (BGP-truth)
For the full members list with live route-server session state, see the dedicated MIX-IT page.
Path-MTU and Type 2 evidence
The active Type 2 test produced definitive verdicts for 240 unique destination IP addresses across vantage points.
- Honored (destination accepted our forged Packet-Too-Big and shrank its next response): 174 ASes - AS137, AS2597, AS3242, AS3302, AS5392, AS5394, AS5398, AS6762 (+166 more)
- Not honored (destination ignored the PTB or the PTB was filtered en route): 66 ASes - AS137, AS2597, AS5392, AS5602, AS8265, AS9026, AS12637, AS12779 (+58 more)
Global BGP visibility (RIPE RIS)
For every ITA prefix we asked all RIPE RIS collectors what AS-paths they currently see. That gives us each AS' direct upstream(s) according to the global BGP table.
RPKI & ASPA
RPKI ROAs cryptographically bind a prefix to its origin AS, so route-leaks and
hijacks of that prefix can be filtered. We validate every announced ITA IPv6 prefix
against the local Routinator (rpki-lju.6connect.com).
Of 406 ITA ASes announcing IPv6:
- 342 (84%%) have at least one valid ROA
- 324 (80%%) have all their IPv6 prefixes covered by valid ROAs
- 64 (16%%) have not signed any of their prefixes
- 3 have at least one invalid prefix (origin or maxLength mismatch)
Per prefix: 773 valid, 4 invalid, 112 not-found (of 889 total).
RPKI-invalid prefixes
- AS3302 AS-RETELIT-IRIDEOS Retelit Digital Services S.p.A. -
2a02:7d8:e00::/44: maxLength too short for the announced prefix - AS60772 SKYTV-AS Sky Italia srl -
2a00:83a0:2310::/44: maxLength too short for the announced prefix - AS214677 DeluxHost Matteo Martelloni trading as DELUXHOST -
2a14:7584:e920::/44: prefix is covered by VRP(s) for different origin AS(es): AS0, AS20473 - AS214677 DeluxHost Matteo Martelloni trading as DELUXHOST -
2a14:7583:a400::/38: prefix is covered by VRP(s) for different origin AS(es): AS6517
Top unsigned ASes (no ROAs)
- AS2594 ASN-CSI CSI Piemonte (1 prefix)
- AS2597 CCTLD-IT Consiglio Nazionale delle Ricerche (11 prefixes)
- AS2598 CNR Consiglio Nazionale delle Ricerche (1 prefix)
- AS3269 ASN-IBSNAZ Telecom Italia S.p.A. (1 prefix)
- AS3313 INET-AS BT Italia S.p.A. (1 prefix)
- AS5602 AS-IRIDEOS-KP Retelit Digital Services S.p.A. (1 prefix)
- AS13182 ASN-ADHOC-NETWORK Made Network Srl (1 prefix)
- AS13253 ISP-ASn4 Intesa Sanpaolo S.p.A. (1 prefix)
- AS16232 ASN-TIM Telecom Italia S.p.A. (1 prefix)
- AS20746 ASN-IDC Telecom Italia S.p.A. (6 prefixes)
- AS21176 ASN-DEBIS Engineering D.HUB S.p.A. (1 prefix)
- AS24994 GENESYS-AS genesys informatica srl (1 prefix)
- AS28999 SIPORTAL-AS Siportal S.r.l. (1 prefix)
- AS29438 MOMAX-AS Momax Network S.r.l. (1 prefix)
- AS31222 ASN-TERRA Mewecom Italia spa (1 prefix)
ASPA (Autonomous System Provider Authorization)
ASPA is a much newer (RFC 9774) RPKI object: it lets a customer AS list which upstream providers may legitimately propagate routes from it. Routes from that AS arriving via any other path are then ASPA-invalid.
44 of 406 ITA ASes have published an ASPA record:
- AS8265 FASTNET-BKB-ASN FASTNET S.R.L. - provider(s): AS6453, AS51569
- AS12637 SEEWEB SEEWEB s.r.l. - provider(s): AS174, AS1299, AS2914, AS3303, AS50673
- AS12779 ITGATE IT.Gate S.p.A. - provider(s): AS174, AS2914, AS3223, AS3257, AS200020
- AS15605 CONNESI Connesi s.p.a. - provider(s): AS3356, AS6762, AS12637, AS41327, AS56911
- AS21034 MICSO-SRL-AS Micso Information Technology Srl - provider(s): AS3269, AS8928, AS12874
- AS24796 NAMEX-IXP NAMEX CONSORZIO - provider(s): AS5394, AS12779, AS39120, AS41327
- AS31034 ARUBA-ASN Aruba S.p.A. - provider(s): AS174, AS1267, AS1299, AS2914, AS3356, AS6762, AS6939, AS9002, AS19905, AS32787, AS200185
- AS31263 MYNET-AS MYNET S.R.L. - provider(s): AS2914, AS3257, AS8928
- AS31319 ESTRACOM-AS ESTRACOM SPA - provider(s): AS174, AS1299
- AS34428 EIGHTROUTE Giulio Lo Presti - provider(s): AS174, AS1299, AS2914, AS3257, AS3356, AS6762
- AS39719 LIGURIADIGITALE_AS Liguria Digitale S.p.A. - provider(s): AS1267, AS3302, AS12874, AS16004, AS61968, AS200199
- AS41327 FIBERTELECOM-AS Fiber Telecom S.p.A. - provider(s): AS1299, AS2914, AS3257, AS3356, AS3491, AS6453, AS6762
- AS41720 NAVIGABENE REVOLUTION PROVIDER SRL - provider(s): AS174, AS1299, AS9002, AS50877, AS60068, AS60798, AS203446, AS212508
- AS56488 EISIT Eis S.r.l. - provider(s): AS1299, AS3356, AS31034
- AS57913 toscanatlc ToscanaTLC s.r.l. - provider(s): AS5398, AS41327
Path asymmetry
For every ITA AS we compared where our outgoing traffic enters their network (the AS just upstream of them on traceroute paths from any of our 14 vantage points) to which AS the global BGP table says is their direct upstream (RIS view). When these disagree, the network is multi-homed and traffic in vs. out takes different paths - normal in well-peered networks but worth surfacing.
182 ITA ASes flagged as asymmetric this run. Most asymmetric examples (low symmetry score):
- AS198747 DaniilGentili Daniil Gentili - symmetry score 0.00; RIS sees upstreams [AS41720] but our paths went via [AS174, AS1299, AS6939, AS204471].
- AS49289 Media-Veneto Omegacom S.R.L.S. - symmetry score 0.00; RIS sees upstreams [AS2593, AS6939, AS24961, AS50877] but our paths went via [AS6762].
- AS49367 ASSEFLOW Seflow s.r.l. - symmetry score 0.00; RIS sees upstreams [AS31034] but our paths went via [AS6939].
- AS209460 Riccardo-Zanol Riccardo Zanol - symmetry score 0.00; RIS sees upstreams [AS41051, AS209533, AS212895] but our paths went via [AS58299].
- AS50201 IMPULSO-AS Impulso Srl - symmetry score 0.00; RIS sees upstreams [AS35661] but our paths went via [AS1299, AS6939].
- AS208229 MICHELE-ROBERTAZZI MICHELE ROBERTAZZI - symmetry score 0.00; RIS sees upstreams [AS41720] but our paths went via [AS174, AS1299, AS6939, AS204471].
- AS60798 ASSERVEREASY Servereasy Srl - symmetry score 0.00; RIS sees upstreams [AS2914, AS3257, AS5405, AS6762] but our paths went via [AS204471].
- AS212539 OTTER-AS Francesco Masala - symmetry score 0.00; RIS sees upstreams [AS208437] but our paths went via [AS6939, AS9002, AS31500].
Bottom line
- 46% of ITA IPv6 networks accept ICMPv6 Echo unrestricted from external probes.
- 43% of ITA IPv6 networks drop all ICMPv6 at their AS edge - a meaningful fraction of the ITA population that some traffic types may struggle to debug against.
- 0% of ITA IPv6-announcing ASes (1) announce a prefix but have no live host inside it -- the AS is reachable in BGP and traceroute steps into its routing infrastructure, but no DNS / hitlist / Atlas / CT discovery method found anything answering. Most likely ‘allocated, announced, never deployed’ -- a different operator action than a firewall: deploy a host, not review the ACL.
- Of the 196 ASes where our active Type 2 test reached a verdict, 170 (87%) proved RFC 4890-compliant. The rest break PMTUD for any flow that needs a smaller path-MTU than 1500.
- The MIX-IT route servers carry the BGP-truth backbone of Italian IPv6: transit relationships visible on rs1 and rs2 today, with the country's largest ISPs dominating the inbound transit graph and a long tail of small ISPs and one-AS enterprises forming the customer base.
This report is regenerated daily at 12:00 Europe/Rome from
data/analyzed.json, data/six_lg.json, data/global_topology.json,
data/ris_bgp.json, data/asymmetry.json and data/type2_results_<vantage>.json.
The text is deterministic - no manual editorial pass.