When checking ROAs, and the source ASN happens to have an AS-SET, bird does not output the ASN itself. Here is an example without an AS-SET: $ birdc 'show route primary table master4 where roa_check(roa_v4, net, bgp_path.last_nonaggregated) = ROA_INVALID' | grep 186.28 186.28.232.0/24 unreachable [BGP1v4 2021-02-11 from 46.30.8.72] * (100) [AS263710i] Here is an example with an AS-SET: $ birdc 'show route primary table master4 where roa_check(roa_v4, net, bgp_path.last_nonaggregated) = ROA_INVALID' | grep 185.186 185.186.206.0/24 unreachable [BGP3v4 2021-02-07 from 192.110.255.57] * (100) [?] The source ASN in the first shows as 263710, but the second shows none at all. This is the actual live prefix for the second: bird> show route all for 185.186.206.0/24 Table master4: 185.186.206.0/24 unreachable [BGP3v4 2021-02-07 from 192.110.255.57] * (100) [?] Type: BGP univ BGP.origin: Incomplete BGP.as_path: 13030 8529 28885 {206350} As the query is specifying last_nonaggregated, I'd expect the output to contain that ASN. Thanks D