How Route Collectors Work

Route collectors are passive BGP speakers that peer with hundreds of networks simultaneously, record every UPDATE they receive, and make the data publicly available. They are the foundation of internet routing research, real-time monitoring tools, and looking-glass services — including this one. Understanding how they work helps you interpret the data they produce and reason about what they can and cannot tell you.

What a Route Collector Is

A route collector establishes standard eBGP sessions with participant networks. Unlike a normal router, it never forwards traffic and never sends UPDATEs back to its peers (it advertises a default route or nothing at all). Its sole job is to receive and archive routing announcements. Because it is passive, operators are generally willing to peer with it — there is no risk of accidentally sending traffic through it.

Route collectors are deployed at Internet Exchange Points (IXPs) and co-location facilities where many networks are already present. A single collector at an IXP can peer with dozens or hundreds of member networks, giving it a rich, multi-vantage-point view of the global routing table.

RIPE NCC Routing Information Service (RIS)

RIPE NCC operates the Routing Information Service (RIS), the largest public route-collector infrastructure. RIS consists of around 26 Remote Route Collectors (RRCs) deployed at major IXPs and hosting facilities worldwide:

Each RRC maintains iBGP-style sessions to all its peers. The full table from each peer is captured and stored. At any given time RIS has visibility into over 1,000 BGP sessions from hundreds of distinct ASes.

RIS Live — Real-Time Streaming API

Beyond the archived MRT files, RIPE NCC offers RIS Live, a WebSocket streaming API that delivers BGP UPDATE messages within seconds of a collector receiving them. The API endpoint is wss://ris-live.ripe.net/v1/ws/. After connecting, you subscribe by sending a JSON message:

{"type": "ris_subscribe", "data": {"type": "UPDATE", "require": "announcements"}}

The server then streams JSON-encoded UPDATE events as they arrive from all RRCs. Each event includes the collector ID, the peer AS, the prefix, the full AS path, and the timestamp. You can filter by prefix, ASN, collector, or peer to limit the stream to what you care about.

This site ingests the RIS Live stream in real time. Every BGP announcement and withdrawal seen by RIPE RIS is processed and stored locally, giving the route lookups you perform here fresh, live data rather than stale snapshots.

University of Oregon RouteViews

The RouteViews project, run by the University of Oregon, is the other major public route-collector infrastructure. RouteViews operates over 30 collectors at IXPs and hosting sites across North America, Europe, Asia-Pacific, Africa, and South America. The data format and access mechanisms are similar to RIPE RIS: BGP table dumps and MRT update files available via anonymous FTP/HTTP, plus a Quagga-based looking-glass interface.

RouteViews and RIPE RIS together cover most of the global routing table from complementary vantage points. Research comparing both infrastructures consistently finds that the union of both views sees more prefixes and more AS path diversity than either alone.

MRT Archive Format

Both RIS and RouteViews store BGP data in MRT (Multi-Threaded Routing Toolkit) format, standardized in RFC 6396. MRT files come in two flavors:

• RIB dumps (TABLE_DUMP_V2) — a snapshot of the full routing table from every peer at a point in time. RIPE RIS publishes these every 8 hours; RouteViews publishes them every 2 hours.
• UPDATE files (BGP4MP) — a sequential log of every BGP UPDATE received between dumps, published in 5-minute or 15-minute intervals.

Tools like bgpdump, bgpscanner, and the Python mrtparse library can decode MRT files into human-readable or structured output. Researchers use MRT archives to reconstruct routing history, analyze route flapping, and measure convergence times after major events.

Looking Glasses

A BGP looking glass is a read-only interface into a router or route-collector's routing table. Traditional looking glasses were simple shell scripts that ran show ip bgp commands on production routers and returned the output over HTTP. Modern looking glasses, including this site, query route-collector data to show live BGP paths, AS path details, and origin information without touching production infrastructure.

BGP Monitoring Tools

Several open-source tools consume route-collector data for operational monitoring:

• BGPalerter — watches RIS Live for anomalies affecting configured prefixes or ASNs. It alerts on hijacks (unexpected origin changes), route leaks, and RPKI invalids in near real time.
• bgpstream (CAIDA) — a C/Python library that provides a unified interface to both RIS and RouteViews MRT data and live feeds, used widely in academic research.
• Grafana + bgp-dashboard — various community tools scrape route-collector APIs and render prefix visibility, path diversity, and update rates as time-series dashboards.
• ripe-stat — RIPE NCC's data API aggregates RIS data into queryable endpoints for prefix history, routing consistency, and visibility across collectors.

CAIDA BGP Data

The Center for Applied Internet Data Analysis (CAIDA) provides the BGPStream framework and maintains historical BGP archives. CAIDA also publishes the RouteViews prefix-to-AS mapping dataset, widely used for research and IP-to-ASN lookup services. This site uses CAIDA's RouteViews data as a bootstrap source for the initial route table before the RIS Live stream fills in real-time updates.

How RIS Live Subscriptions Work

The RIS Live WebSocket API allows filtered subscriptions. After connecting, you can subscribe with parameters like:

{"type": "ris_subscribe", "data": {
  "type": "UPDATE",
  "prefix": "8.8.8.0/24",
  "more_specifics": true
}}

This delivers only UPDATEs related to that prefix and its more-specific sub-prefixes — useful for monitoring a specific customer's address space. Other filter options include path (match AS path regex), peer (specific collector peer ASN), and host (specific RRC). Without filters, the firehose delivers thousands of UPDATEs per second during busy periods.

Each UPDATE event contains:

• timestamp — Unix timestamp of when the collector received the UPDATE
• peer — IP address of the BGP peer that sent it
• peer_asn — ASN of the peer
• host — which RRC received it (e.g., rrc03)
• announcements — list of {prefix, next_hop} pairs
• withdrawals — list of withdrawn prefixes
• path — the AS path as an array of AS numbers
• community — BGP communities as {asn, value} pairs

Historical Analysis with MRT Files

For historical research — studying a past BGP incident, measuring routing table growth, analyzing convergence after a major event — MRT archives are the primary resource. RIPE NCC archives RIS data at https://data.ris.ripe.net/, organized by RRC and time. RouteViews data lives at archive.routeviews.org. Files are retained indefinitely; you can fetch routing table snapshots from 1999 onward.

A typical research workflow:

1. Download RIB dump files bracketing the time window of interest.
2. Download UPDATE files covering the interval.
3. Use bgpdump -m to convert MRT to machine-readable pipe-separated text, or use bgpscanner for faster processing.
4. Reconstruct the routing table state at any point by replaying UPDATEs over the last RIB snapshot.
5. Analyze prefix announcements, AS path changes, and withdrawal patterns.

Limitations of Route Collectors

Route collectors give a valuable but incomplete picture. Key limitations:

• Vantage-point bias — a collector only sees routes that its peers choose to advertise to it. Routes filtered by BGP policy before reaching the collector are invisible.
• Best-path only — most peers send only their locally selected best path, not all paths they know. A prefix may have multiple AS paths globally but a collector sees only the one its peer prefers.
• No traffic data — route collectors see control-plane announcements, not data-plane traffic. A prefix visible in the routing table may carry zero actual traffic.
• Collector outages — RRC sessions reset, causing gaps in update logs. RIB dumps help reconstruct state, but short outages can cause missed withdrawals or announcements.
• Geography gaps — despite dozens of collectors, some regions of the internet (parts of Africa, Central Asia) are underrepresented. BGP paths from underrepresented regions may not be captured at all.

From Collector Data to BGP Alerts

Monitoring tools translate the raw UPDATE stream into actionable alerts. BGPalerter, for example, maintains a local model of which prefixes you own and which ASes should originate them, derived from your IRR records and RPKI ROAs. When an UPDATE arrives showing a different origin AS or a more-specific prefix from an unexpected AS, it fires an alert. The latency from routing change to alert is typically under 60 seconds via RIS Live — fast enough to catch most BGP hijacks before significant traffic is affected.

RIPE NCC's own RIPE Stat platform aggregates RIS data into an API covering routing history, BGP update frequency, prefix visibility (what fraction of RIS collectors see a prefix), and routing consistency. The BGP looking glass concept is directly built on top of collector data, letting operators and researchers query the live routing table from multiple vantage points simultaneously.

Explore It Live

The route data on this site comes directly from RIPE RIS via the RIS Live WebSocket feed. You can see the multi-vantage-point view in action:

• AS13335 — Cloudflare, peered at hundreds of IXPs where RIS collectors also sit
• 8.8.8.8 — Google DNS, visible from nearly every RIS collector
• AS6939 — Hurricane Electric, a major transit provider that peers widely with RIS collectors

Use the looking glass to examine live BGP paths and see which collectors are reporting routes to any prefix or ASN.