So the first question is what is a BGP Looking Glass?
It’s an essentially remote router that you access via a CLI terminal (e.g. Telnet), a web interface or sometimes an API which allows you to see:
- How that network sees (your) routes.
- Their BGP routing table.
- Their best paths.
- Their neighbours.
So why would you want to use a Looking Glass? Put simply, to answer questions such as the below, which you cannot answer from your own network; essentially you’re getting another network’s perspective of how your network looks.
- Is/are my routes (network prefixes) visible on the Internet?
- Which path is another AS using to reach my network(s)?
- Has someone hi-jacked my network prefixes (routes)?
- Why is traffic using the wrong link into my network (AS)?
Where can I find a BGP Looking Glass?
There are a number of BGP Looking Glasses available all around the world which are free to access. A couple of really good places to start are:
- https://routeviews.org/
- https://bgp.he.net/
- https://lg.he.net/
- http://www.traceroute.org/#Looking%20Glass (Massive List)
These sites are either BGP Looking Glasses, or provide a list of submitted Looking Glasses for you to use.
How can I use a BGP Looking Glass?
So in terms of the BGP test lab we’ve been using up until now, we don’t have this connected directly to the Internet, so we don’t have anything we can test with, but let’s find something we can.
Find Your Autonomous System (AS)
If we use https://bgp.he.net/ and we look up say the BBC, we can see the following:
Let’s have a look at AS2818, then click on “Prefixes v4”, so we can see the network prefixes (routes) that are being advertised out under this AS.
OK, so we can see there are four network prefixes. At the time of writing, if we perform a DNS lookup of www.bbc.co.uk we get the IP Address: 212.58.237.1, so that appears to be within the 212.58.224.0/19 subnet, i.e. the bottom one in the list.
We’ve now got some information we can work with and use on the BGP Looking Glass to see what is going on, and explore how you as a network administrator could use these tools to find out information about your network.
Use Looking Glass
For the purposes of this example we’re going to use routeviews.org, we’ll connect up to their router via the link (which should launch Telnet) and then login.
Once logged in successfully, we are ready to start exploring.
Note that this is a collector, although it is likely a router, it’s a collector of routes, so not a real live used router.
Find Network Prefix
So we’ve got our example network prefix 212.58.224.0/19, let’s see what this router sees of this network prefix?
show ip bgp 212.58.224.0/19We then get the following output:
BGP routing table entry for 212.58.224.0/19, version 1031187477
Paths: (16 available, best #10, table default)
Not advertised to any peer
Refresh Epoch 1
20912 9002 2818
77.39.192.30 from 77.39.192.30 (77.39.192.1)
Origin IGP, localpref 100, valid, external
Community: 9002:9002 9002:64679 20912:65001 20912:65016
path 7F15FCEBD868 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
8283 1299 2818
94.142.247.3 from 94.142.247.3 (94.142.247.3)
Origin IGP, localpref 100, valid, external
Community: 1299:30000 8283:1 8283:101
unknown transitive attribute: flag 0xE0 type 0x20 length 0x18
value 0000 205B 0000 0000 0000 0001 0000 205B
0000 0005 0000 0001
path 7F161F52D998 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
7018 1299 2818
12.0.1.63 from 12.0.1.63 (12.0.1.63)
Origin IGP, localpref 100, valid, external
Community: 7018:5000 7018:37232
path 7F15E2BF30C8 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
3333 1257 3356 2818
193.0.0.56 from 193.0.0.56 (193.0.0.56)
Origin IGP, localpref 100, valid, external
Community: 1257:50 1257:53 1257:3528
path 7F16C4F8BA30 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
57866 1299 2818
37.139.139.17 from 37.139.139.17 (37.139.139.17)
Origin IGP, metric 0, localpref 100, valid, external
Community: 1299:30000 57866:100 65100:1299 65103:3 65104:31
unknown transitive attribute: flag 0xE0 type 0x20 length 0x30
value 0000 E20A 0000 0064 0000 0513 0000 E20A
0000 0065 0000 0064 0000 E20A 0000 0067
0000 0003 0000 E20A 0000 0068 0000 001F
path 7F164419E498 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
3356 2818
4.68.4.46 from 4.68.4.46 (4.69.184.201)
Origin IGP, metric 0, localpref 100, valid, external
Community: 3356:2 3356:22 3356:100 3356:123 3356:500 3356:903 3356:2073
path 7F15BCC15348 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
3549 3356 2818
208.51.134.254 from 208.51.134.254 (67.16.168.191)
Origin IGP, metric 0, localpref 100, valid, external
Community: 3356:2 3356:22 3356:100 3356:123 3356:500 3356:903 3356:2073 3549:2581 3549:30840
path 7F157B179578 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
4826 6939 2818
114.31.199.16 from 114.31.199.16 (114.31.199.16)
Origin IGP, localpref 100, valid, external
Community: 4826:5901 4826:6150 4826:59013 6939:7318 6939:8826 6939:9002
path 7F16B2770A48 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
3257 3356 2818
89.149.178.10 from 89.149.178.10 (213.200.83.26)
Origin IGP, metric 10, localpref 100, valid, external
Community: 3257:8225 3257:30141 3257:50001 3257:54900 3257:54901
path 7F15ED5D43D8 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
6939 2818
64.71.137.241 from 64.71.137.241 (216.218.253.53)
Origin IGP, localpref 100, valid, external, best
path 7F169C66AB00 RPKI State not found
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 1
20130 6939 2818
140.192.8.16 from 140.192.8.16 (140.192.8.16)
Origin IGP, localpref 100, valid, external
path 7F16B4C9CBF8 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
101 3356 2818
209.124.176.223 from 209.124.176.223 (209.124.176.224)
Origin IGP, localpref 100, valid, external
Community: 101:20100 101:20110 101:22100 101:24100 3356:2 3356:22 3356:100 3356:123 3356:500 3356:903 3356:2073
Extended Community: RT:101:22100
path 7F16C09C0D30 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
1351 6939 2818
132.198.255.253 from 132.198.255.253 (132.198.255.253)
Origin IGP, localpref 100, valid, external
path 7F160B9BB130 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 2
3303 3356 2818
217.192.89.50 from 217.192.89.50 (138.187.128.158)
Origin IGP, localpref 100, valid, external
Community: 3303:1004 3303:1006 3303:3050 3356:2 3356:22 3356:100 3356:123 3356:500 3356:903 3356:2064 3356:11078
path 7F1584A47F48 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
2497 1299 2818
202.232.0.2 from 202.232.0.2 (58.138.96.254)
Origin IGP, localpref 100, valid, external
path 7F166C2D0240 RPKI State not found
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
49788 12552 2818
91.218.184.60 from 91.218.184.60 (91.218.184.60)
Origin IGP, localpref 100, valid, external
Community: 12552:12000 12552:12400 12552:12401 12552:22000
Extended Community: 0x43:100:1
path 7F16C65FF9E8 RPKI State not found
rx pathid: 0, tx pathid: 0As you can see there is a lot to digest there, so let’s break it down. First up, we can see there are 16 available routes, but we’re only seeing the best 10.
Which is the path (route) that this router thinks is the “best path” to reach our network prefix? Let’s find out by running the following:
OK, so this is the best path, let’s have a look at some of the information we’ve got out of it.
Routing Table Entry
First up, the BGP Routing Table entry, what this means is we have a route table entry for our network prefix in the collector, followed by a version number, this is an internal table-change counter, it can be useful to see how the table has changed over time.
BGP routing table entry for 212.58.224.0/19, version 1031187477Paths Learned
Next we see that this collector (router) has learned 16 different paths for our network prefix, it’s only showing the best 10 in the output, in by using the “best path” argument, it is just showing the best path it has!
As we have learned during this series, BGP doesn’t just learn one route, it learns many routes, and then just picks the best path out of them.
Paths: (16 available, best #10, table default)Advertised Status
If we were to see this on a normal router, it means that the route is not being sent onward to other routers, but as this is a Looking Glass collector, it only really reflects it is a collector and not a real router.
Not advertised to any peerRefresh Epoch
The Refresh Epoch (which doesn’t always appear) is a value that shows which refresh cycle the current route (network prefix) information belongs to. It becomes useful when you say change a route policy or trigger a soft-reset of a BGP Neighbour, you can with this see which routes have been re-learned being that they are the ones with the higher value. So for example:
- Epoch 1 → original routes
- Epoch 2 → after first refresh
- Epoch 3 → after another refresh
Essentially it’s a counter for routing updates.
Refresh Epoch 1AS Numbers
What we can see here are AS Numbers which are within the AS_PATH. Read from left to right to show which AS has the route been learned from, and what the path of AS that the traffic would pass through to reach the destination AS (and network). What’s interesting here is the BBC’s AS is 2818, so we see that as the last AS number, and then the AS number 6939. Which implies the traffic only goes via one AS to reach its destination AS, it’s likely because the BBCs networks are well peered.
Operationally, this line tells you:
- which upstreams the route passed through
- whether someone is prepending
- whether the path looks normal or suspicious
In our case all looks good.
6939 2818Next Hop / Peer Source
On a real router this helps you identify which BGP Neighbour was this particular path learned from.
64.71.137.241 from 64.71.137.241 (216.218.253.53)Attributes
Now for some attributes. Firstly “Origin IGP”, we covered this in an earlier article, but the value could be IGP, EGP or ?, the EGP is historical so you won’t see it used any more, so its only IGP and “?” we need to consider. This value shows how BGP learned the route. The value of “IGP” means that the route originated from someone specifically adding the “Network” command on a router to add this network route to BGP. If the value here was “?” instead, that would typically mean that in the BBC network somewhere a route was “redistributed” (or Exported) from another protocol (e.g. OSPF, EIGRP, static etc.).
What’s the other things, well, we have LocalPref which is the BGP value of how preferred this route is compared to others. 100 is typically the default, the higher the value the more preferred. So it’s used within an AS to influence how traffic leaves the network.
“Valid” just means that BGP considers the route is valid, “External” just means it was learned via eBGP, rather than iBGP; and of course “Best” just means it is the best route and only one route would have this (unless ECMP is in use potentially).
Origin IGP, localpref 100, valid, external, bestThe value of “path”, i.e. the hexadecimal string is a memory pointer ID.
path 7F169C66AB00 RPKI State not foundThe RX PathID is a value which is zero if not specifically enabled, and they are assigned and received from the sending BGP neighbour, it’s to distinguish between multiple paths for the same prefix.
The TX PathID is assigned locally, and used when sending multiple paths to neighbours (so the remote router can identify each), again normally zero if not used. You may see these when using Route Reflectors, or in ECMP designs.
rx pathid: 0, tx pathid: 0x0So what have we actually learned from all of this?
Well, we have learned that there are a number of possible routes that this Looking Glass collector could take to go to the AS for the BBC, but the best path selected is the one via the AS Path 6939 2818 with the next-hop of: 64.71.137.241
Perform a Traceroute
When writing this I had trouble with the previously used Looking Glass, so I’ve selected another one: lg.eastlink.ca
So if then performing from: East Atlantic (AS11260), first we’ll look at the route information, I’ve cut down the result to just the best path:
Sun Mar 22 10:07:49.986 ADT
BGP routing table entry for 212.58.224.0/19
Versions:
Process bRIB/RIB SendTblVer
Speaker 1804324008 1804324008
Last Modified: Mar 20 23:58:57.032 for 1d10h
Paths: (7 available, best #1)
Not advertised to any peer
Path #1: Received by speaker 0
Not advertised to any peer
1299 2818, (received & used)
62.115.147.124 (metric 140) from 24.137.100.55 (24.137.100.2)
Origin IGP, localpref 100, valid, internal, best, group-best, multipath
Received Path ID 1, Local Path ID 1, version 1652255609
Community: 1299:30000 11260:1 11260:10 11260:10000 11260:10100 11260:10112
Originator: 24.137.100.2, Cluster list: 0.0.43.252
Path #2: Received by speaker 0
Not advertised to any peerWe can see here that the AS Path is 1299, 2818.
I also had trouble performing a traceroute from this too.
Something Else
So instead trying to traceroute from a Looking Glass to my website: www.geekmungus.co.uk, what do we then get? The IP that comes back is 178.18.126.4.
Looking up the IP address on: https://bgp.he.net/ip/178.18.126.4
We can see it is AS34762 within the route: 178.18.126.0/23.
Using the Public Route Server we can see the result: route-server.he.net.
route-server> show ip bgp 178.18.126.0/23 bestpath
BGP routing table entry for 178.18.126.0/23
Paths: (18 available, best #17, table Default-IP-Routing-Table)
Not advertised to any peer
48185 34762
216.218.253.2 from 216.218.252.67 (216.218.253.2)
Origin IGP, metric 0, localpref 100, valid, internal, best
Originator: 216.218.253.2, Cluster list: 216.218.252.67
Last update: Tue Mar 17 09:13:58 2026So in this case the best path has been learned via AS48185.
However, these are potentially different Routers with different views of the world.
When we perform the traceroute, we can see it goes via a number of different intermediate AS to reach the final destination, in the output below.
What we are looking for here is that the route taken is the one we are expecting for the ingress into our network, perhaps we are looking for a particular upstream router to be present. All information that we can’t get ourselves directly from our network, because we need to see the network as observed from the outside.
Another Method for Traceroute
The Super Looking Glass https://bgp.he.net/super-lg can give some more detail and information which can be really useful. For example looking for our subnet via this, we can see:
So looking at this, we can see a bird’s eye view of how the Internet sees our subnet being advertised.
Notice that the first AS on each route is 34762, which is the AS we are expecting to be there, i.e. our AS. If this wasn’t the first, it would point to something either configured incorrectly, or someone attempting to advertise our network prefix in an attempt to redirect traffic, of course whether they had done that as a typo or deliberately you wouldn’t know without some investigation.
AS Lookup
You can see the information for a particular AS number using the following link: https://bgp.he.net/AS786 (substituting your own AS number in the URL). I’m using this as an example because it is the ISP we use at the time of writing.
Here you can find the information on all the prefixes being originated, how many AS’s this AS peers with, which gives you an idea of how well connected the AS is.
You can also use different probes to run some tests from as well.
