Skip to content

Data Sources

Jump to bottom
Herve Hildenbrand edited this page Jan 20, 2026 · 1 revision

Data Sources

BGP Explorer integrates multiple data sources to provide comprehensive routing information.

Overview

Source Type Data Provided Required?
RIPE Stat REST API Current BGP state, routing history, RPKI validation Yes (always available)
bgp-radar Subprocess Real-time anomaly detection (hijacks, leaks, blackholes) No
Monocle CLI AS relationships (peers, upstreams, downstreams) Yes (installed via install-deps)
Globalping REST API Global ping, traceroute, MTR, DNS measurements No
PeeringDB CAIDA dump Network info, IXP presence, NOC contacts No
BGPStream Library Historical BGP data from RouteViews and RIPE RIS No

RIPE Stat

Type: REST API URL: https://stat.ripe.net/data/ Documentation: RIPE Stat Data API

What it provides

  • Current BGP state for any prefix
  • Routing history with time ranges
  • RPKI validation status
  • ASN information and announcements
  • Visibility across RIPE RIS collectors

Endpoints used

Endpoint Purpose
/bgp-state/ Current routing state
/routing-status/ Prefix routing status
/routing-history/ Historical routing data
/rpki-validation/ RPKI ROA validation
/announced-prefixes/ ASN announcements
/searchcomplete/ ASN search

Rate limits

RIPE Stat has rate limits but they're generous for normal use. The built-in cache (5-minute TTL) reduces repeated API calls.

bgp-radar

Type: Go subprocess Repository: github.com/hervehildenbrand/bgp-radar Required: No (optional for real-time monitoring)

What it provides

Real-time BGP anomaly detection from RIPE RIS Live:

Event Type Description
Hijack Unauthorized prefix origination
Leak Route leak (prefix seen where unexpected)
Blackhole Prefix withdrawal or blackhole announcement

How it works

  1. bgp-radar connects to RIPE RIS Live WebSocket
  2. Monitors BGP UPDATE messages in real-time
  3. Applies detection algorithms
  4. Outputs JSON events to stdout
  5. BGP Explorer reads and parses events

Output format

{
  "type": "hijack",
  "severity": "high",
  "affected_prefix": "203.0.113.0/24",
  "affected_asn": 64496,
  "detected_at": "2024-01-15T10:30:00Z",
  "details": {
    "expected_origin": 64496,
    "observed_origin": 65001,
    "collector": "rrc00"
  }
}

Running standalone

# Basic monitoring
bgp-radar -collectors=rrc00,rrc01

# With persistence (PostgreSQL + Redis)
bgp-radar -collectors=rrc00 -database=postgres://... -redis=redis://...

Monocle

Type: Rust CLI Repository: github.com/bgpkit/monocle Required: Yes (installed via install-deps)

What it provides

AS relationship data derived from observed BGP routing:

  • Peer relationships
  • Upstream transit providers
  • Downstream customers
  • Relationship classification (peer/upstream/downstream)

Data source

Monocle uses BGPKIT's AS relationship dataset, built from:

  • 1,700+ global BGP peers
  • Daily updates
  • Observed routing behavior (not policy databases)

Visibility percentage

Each relationship includes a "visibility percentage" indicating how many BGP peers observe the relationship. Higher visibility = more confident classification.

Commands used

# Get peers for an AS
monocle as-rel --as 13335 --rel-type peer

# Get upstreams
monocle as-rel --as 13335 --rel-type provider

# Get downstreams
monocle as-rel --as 13335 --rel-type customer

# Check specific relationship
monocle as-rel --as 13335 --as2 6939

Globalping

Type: REST API URL: https://api.globalping.io/v1/ Documentation: github.com/jsdelivr/globalping

What it provides

Network measurements from globally distributed probes:

Test Type Description
Ping ICMP ping with latency and packet loss
Traceroute Path tracing with hop-by-hop latency
MTR Combined ping + traceroute
DNS DNS resolution from multiple locations
HTTP HTTP request measurements

Probe locations

Probes are available in:

  • All continents
  • Major cities worldwide
  • Various ISPs and networks

Rate limits

  • Free tier: Limited requests per minute
  • Register for higher quotas
  • Credits available for heavy usage

Location filters

# By country code
locations=["US", "DE", "JP"]

# By continent
locations=["EU", "AS"]

# By region name
locations=["Europe", "North America"]

PeeringDB

Type: CAIDA SQLite dump Source: CAIDA PeeringDB dumps Refresh: Manual or on-demand

What it provides

  • Network information (name, type, website)
  • IXP presence and peering locations
  • Connection speeds at IXPs
  • NOC/abuse/technical contacts

Data freshness

PeeringDB data is downloaded from CAIDA's daily dumps. Use --refresh-peeringdb to update:

uv run bgp-explorer --refresh-peeringdb chat

Contact information

Contact data is voluntarily submitted by network operators. Not all networks have complete contact information.

BGPStream

Type: Python library (with C dependency) Documentation: bgpstream.caida.org Required: No (optional)

What it provides

Historical BGP data from:

  • RIPE RIS (Route Information Service)
  • RouteViews (University of Oregon)
  • CAIDA BGPStream archives

Installation

Requires the libBGPStream C library:

# macOS
brew install bgpstream

# Then install Python binding
uv sync --extra bgpstream

Use cases

  • Deep historical analysis
  • Research and academic use
  • When RIPE Stat history isn't sufficient

Data Source Priority

When answering questions, Claude uses this priority:

  1. Live data first: Current state from RIPE Stat
  2. Relationships from Monocle: Most accurate for AS relationships
  3. Real-time from bgp-radar: If monitoring is enabled
  4. Contacts from PeeringDB: For incident coordination
  5. Probing via Globalping: For reachability testing

Next Steps

Clone this wiki locally