BGP (RIS Live)

An external module for Wayseer Desktop that shows live BGP routing from RIPE RIS Live. You name the prefixes and origin ASes to watch. The module then shows who announces them, through which AS paths, which peers and collectors see them, and how their routes change. It raises events for possible hijacks, origin changes, new more-specifics, withdrawals and path changes.

It is not built into the app. It runs as its own program from a signed package, as wayseer-labs/bgp in the namespace bgp. Like every Wayseer module it is a lens, not a store. It keeps only a bounded working set in memory and forgets what it no longer sees.

Configuration

modules:
  - kind: external
    name: bgp
    options:
      module: wayseer-labs/bgp
      options:
        prefixes: [193.0.0.0/21, 2001:67c:2e8::/48]
        expect: {193.0.0.0/21: [3333], 2001:67c:2e8::/48: [3333]}
        hosts: [rrc00, rrc21]

At least one of prefixes or origins is required, and types must include UPDATE. Each host and peer you name multiplies the subscriptions, and a config that needs more than 64 is refused. RIS Live is never asked for its unfiltered stream.

What it shows

Edges. An AS talks_to the next AS toward the origin in a path, so the arrows follow traffic toward the prefix. The origin AS owns the prefix it announces, and a peer's AS owns the peer. A peer is a member_of its collector. A watched prefix is the parent_of its more-specifics, and a less-specific is the parent_of the watched prefix.

Status of a prefix. The status is crit when an origin isn't one expect names. It is down once every peer seen carrying the prefix has withdrawn it, and warn when more than one AS originates it. It is unknown until an announcement is seen. RIS Live streams only changes, so the module starts empty and learns routes as peers announce them. A route that is never re-announced is still kept until it is withdrawn.

Series, one point per interval:

Events:

Bounds. Watched prefixes are always kept. Other prefixes, ASes, adjacencies, peers (1000) and collectors (64) are capped, and the least recently seen go first. Whatever no current route uses is forgotten after stale_after. At most 500 events are kept between sends, and the rest are counted in one dropped event. Each series keeps 360 points.

Connection. The module reconnects after a dropped stream. It waits 1s, then twice as long each time, up to a minute, and starts again from 1s once a stream has lasted a minute. A ris_error from RIS Live shows as the module's error, and a message it can't read shows as a note. The WebSocket connects directly. The HTTP stream honours HTTPS_PROXY.

Data source and attribution

The data comes from the RIPE NCC's Routing Information Service (RIS), at <https://www.ripe.net/ris>, through RIS Live. Its use falls under the RIPE NCC's terms of service for the website and its publicly available services. Commercial use is allowed under the RIPE NCC's RIS commercial use rules, which ask for the RIPE NCC logo, a link to <https://www.ripe.net/ris>, and this description:

The RIPE Routing Information Service (RIS) is a RIPE NCC service. With the help of network operators all over the world, RIS employs a globally distributed set of Remote Route Collectors (RRCs), typically located at Internet Exchange Points, to collect and store Internet routing data. Volunteers peer with the RRCs using the BGP protocol and RIS stores the update and withdraw messages. RIS data can be accessed via: - RIPEstat, the "one-stop shop" for all available information about Internet number resources. RIPEstat uses individual widgets to display routing and other information; - RIS Live, a real time BGP streaming API allowing server-side filtering of BGP messages by prefix or autonomous system; - RIS Raw Data, available for each route collector, with state dumps and batches of updates made available periodically; - RISwhois, that searches the latest RIS data for details of an IP address using a plaintext "whois"-style interface. It is useful when querying RIS data using scripts.

RIS Live needs no account. Set client to name yourself, and keep your filters narrow. RIPE closes connections that can't keep up.