BGP routes: from looking glasses to live lookups
Networks exchange reachability information for IP addresses through the Border Gateway Protocol (BGP). These messages describe paths to destination prefixes as sequences of Autonomous System Numbers (ASNs), each representing an organization operating part of the Internet's infrastructure. When operators troubleshoot reachability problems or evaluate a resource's global visibility, these BGP paths are typically the first place they look.
Individual looking glasses offer data from a single provider's routers only. Aggregated services like bgp.tools, bgp.he.net, RouteViews, and the NLNOG RING looking glass pool data from many organizations, but they rarely expose the programmatic API access needed for automation. Detecting route leaks or hijacks, for instance, requires machine-readable interfaces.
Cloudflare Radar now offers a real-time BGP route lookup service, both on prefix pages in the web interface and through the free Radar API. The service builds on public data sources and provides near-instantaneous views of global routing state.
Visualizing paths on Radar prefix pages
For any prefix page, the route visualization appears as a Sankey diagram. To avoid visual overload, the default view shows only routes toward Tier 1 networks. For 1.1.1.0/24, for example, the diagram makes clear that AS13335 (Cloudflare) announces the prefix and maintains direct connections with nearly all U.S.-based and international Tier 1 providers.
A "Show full paths" option expands the view to all BGP routes from the prefix to the route collectors. The interactive diagram supports pan and zoom; hover tooltips reveal which collector observed a route and when it last updated. Above the visualization, an origin table lists each originating AS, the visibility percentage (the share of collectors seeing that origin announcement), and RPKI validation status.
During a detected BGP misconfiguration, two origin ASNs appeared for one prefix: AS3 was incorrectly used instead of the intended origin, which should have been prepended three times. The visualization flagged AS3 as RPKI invalid with low visibility, signaling limited acceptance across the network. Operators can inspect such issues directly or in the table, then monitor corrections by refreshing the page.
Prefixes can be searched from Radar's search bar, and prefix pages are reachable from route leak and origin hijack event pages, supporting real-time debugging of anomalies.
REST access for automation
Developers can also fetch the same data through the API. An HTTP GET request returns the current routes for a prefix, and tools like jq allow further filtering. One example queries 1.1.0.0/24 and filters for all routes whose AS paths contain AS174. The result is a JSON array of route objects that includes the BGP route collector, community values, and the timestamp of the last update for each entry.
The API response also includes metadata about collector status and aggregated prefix-to-origin data. In the earlier misconfiguration scenario, the RPKI invalid AS3 origin appears directly in the JSON, noting that only 9% of collectors observed that announcement.
Collecting and organizing data
Radar's routing services rely on RIPE RIS and the University of Oregon's RouteViews as primary BGP data sources. These providers maintain route collectors connected to routers across a diverse set of networks. Routers forward BGP messages to the collectors, which publish periodic data dumps: both update message collections and full routing table snapshots (RIB dump files).
For stable metrics like global routing statistics, Radar processes RIB dumps from archives as they become available. For dynamic events such as leaks and hijacks, it processes update files in batches, with delays of 10 to 30 minutes at the collectors. The new real-time routes feature needed to shrink that delay from minutes to seconds. By tapping RIS Live WebSocket streams from RIPE RIS and OpenBMP Kafka streams from RouteViews, an additional component continuously refreshes route snapshots built from MRT archive files.
The actor model design
Route data is organized in BGP routes snapshots, a queryable repository using a trie structure keyed by prefix. Each node stores routing information contributed by different peering routers. To keep data volumes manageable, snapshots are partitioned by collector: one snapshot per collector, each fed by its own stream. This lets the system scale horizontally and include or exclude collectors independently.
Collectors hold their route information autonomously, so the implementation follows the actor model. Each collector runs as an independent actor on its own thread, communicating with a central controller over a dedicated channel. The controller signals each actor to begin gathering archival and real-time data. When a user query arrives, the controller forwards it to all actors, each of which looks up its prefix-trie and returns results. The controller aggregates the replies into a single response while the underlying streaming and snapshot updates proceed uninterrupted.
This design allows one node to hold hundreds of full routing tables in memory. The deployment currently uses eight route collectors containing 261 full tables, consuming about 45 GB of memory — roughly 170 MB per table.
Live BGP route data now available on Cloudflare Radar
Cloudflare Radar has added a real-time BGP route lookup feature, giving network operators and researchers a way to inspect current Internet routing state rather than relying solely on historical archives. The tool pulls from live data streams provided by RouteViews and RIPE RIS, offering near-instantaneous visibility into how prefixes are being announced and propagated across the global routing table.
The new capability is integrated directly into Cloudflare Radar's prefix pages. For any given prefix, users can now view a Sankey diagram that depicts the route in real time, showing the complete path from the origin AS through intermediate hops to the observer. This visual representation makes it easier to grasp complex routing relationships at a glance, without needing to parse raw BGP updates or dig through command-line tools.
Programmatic access via the Radar API
In addition to the web interface, the same real-time route data is exposed through the Cloudflare Radar API. This allows developers and network engineers to embed live BGP visibility into their own dashboards, alerting systems, or analysis pipelines. The API delivers the identical information shown in the Sankey diagrams, formatted for machine consumption.
The shift toward real-time data marks a departure from the more traditional approach of analyzing BGP updates after the fact. By leveraging the continuous streams from RouteViews and RIPE RIS, Cloudflare Radar can present a snapshot of the routing table that reflects conditions as they exist now, which is particularly valuable during outage investigations, route leak detection, or when verifying the impact of a new announcement.
The feature rounds out Cloudflare Radar's existing suite of tools for monitoring Internet disruptions, routing anomalies, traffic shifts, attack activity, and connection quality. Operators who need to correlate a routing event with other network phenomena can now do so with fresh data, directly on the platform or through the API.
