ASN & BGP prefix lookup

What this tool checks

The ASN & BGP prefix lookup shows how an AS number, IP address or prefix appears in the global routing table. The data comes from RIPEstat, built on the RIPE NCC Routing Information Service (RIS), whose route collectors peer with hundreds of networks worldwide.

For an AS number (AS64496 or 64496) it shows:

• the holder name and the registry block the number comes from;
• the prefixes the AS is announcing right now, split into IPv4 and IPv6;
• up to 15 of the strongest neighbours seen to its left in AS paths, normally its upstreams and peers.

For an IP address or prefix (written like 192.0.2.1 or 2001:db8::/32, though these documentation ranges themselves are refused) it shows:

• the announced prefix and its origin AS. If the exact prefix is not announced, it uses the covering less-specific route;
• the RPKI route origin validation status for each origin AS;
• visibility: how many RIS peers see the route;
• when it was first seen, covering prefixes and more-specific prefixes.

RIS is a large sample of the internet, not all of it, so a route seen everywhere in RIS may still be filtered elsewhere. The tool shows current routes, not history. Private, documentation and other special-use addresses are refused. For registration data, use the WHOIS / RDAP lookup.

For the ROAs behind an RPKI status, use the RPKI / ROA validator. For a network's peering policy and exchange ports, use the PeeringDB lookup.

Reading the results

For an AS number:

• AS announces N IPv4 and N IPv6 prefixes - a pass.
• No IPv6 prefixes announced - a warning when an AS has IPv4 routes only.
• AS is not announcing anything right now - for information.

Up to 200 announced prefixes are listed; click one to look it up. Click an upstream to look up that AS.

For an address or prefix:

• Announced as a prefix by an AS - a pass, naming the route and its origin.
• Not announced in the global routing table - a warning. No RIS peer has a route covering it.
• More than one origin AS (MOAS) - a warning: sometimes intended (anycast, DDoS scrubbing), sometimes a hijack or leak.
• RPKI valid - a pass: a ROA authorises this origin AS and prefix length.
• RPKI invalid - a failure: a ROA exists but does not allow this origin or prefix length.
• No ROA covers this route (RPKI not found) - a warning.
• Seen by N% of RIPE RIS peers - a pass at 90% or more, a warning below.

Common problems and fixes

RPKI not found

Create a ROA (Route Origin Authorisation, RFC 6480) in your regional internet registry's portal. It states which AS may originate the prefix and the longest prefix length allowed. For example, a ROA for 192.0.2.0/24 with origin AS64496 and max length 24.

RPKI invalid

Check that the ROA's origin AS matches the announcing AS and that its max length covers the announced prefix: a /24 under a ROA for a /22 with max length 22 is invalid. Fix the ROA or stop announcing the route.

Low visibility

Common causes are a missing IRR route object (many providers build filters from IRR data), an RPKI invalid state, or a prefix that is too long: most networks accept nothing longer than a /24 for IPv4 or a /48 for IPv6.

Unexpected origin AS

If the origin is not your AS, contact your upstreams straight away, and make sure valid ROAs exist so networks doing route origin validation reject the bogus route.

No IPv6

Get an IPv6 allocation from your registry, ask your upstreams for IPv6 transit and announce it. The subnet calculator helps plan the split.

FAQ