BGP Lookup & RPKI Check
A BGP looking glass shows how the global routing system sees an IP prefix — who originates it, how widely it is seen, and whether its route origin is authorised by an ROA. Enter an IP address, a CIDR prefix or an AS number and read the answer from live routing data collected around the world.
Last updated:
Routing problem you want watched continuously? Monitor this free with myeventwatch — expiry and downtime alerts, no card required.
What a BGP lookup actually checks
The internet has no central map. Every network — every autonomous system, or AS — tells its neighbours which IP prefixes it can reach, those neighbours pass the news on, and the global routing table is simply the sum of those announcements as heard by collectors scattered around the world. A BGP lookup asks those collectors what they currently hear for one prefix: which AS originates it, meaning which network claims to be its home, and which paths traffic would follow to get there. That is a very different question from who owns the address block on paper. Registration records say who should announce a prefix; the routing table says who actually does, right now — and when the two disagree, the routing table is the one your traffic obeys.
Visibility is the second signal on this page, and it catches a different class of problem. A healthy, well-connected prefix is seen by nearly every collector peer; a prefix seen by only a few is either very new, deliberately local, or leaking or filtered somewhere it should not be. The count shown here — how many RIS peers see the prefix out of the total reporting — turns “is my route out there?” from a guess into a number. First-seen and last-seen timestamps complete the picture: a prefix whose first-seen date is today is a change, not a steady state, and a route that flaps in and out of the table will show a last-seen pattern no static database record ever reveals.
RPKI: is the origin authorised?
Announcements are claims, and for decades nothing stopped any network from claiming any prefix — by accident, through a fat-fingered filter, or on purpose, in a hijack. RPKI is the fix: the holder of a prefix publishes a Route Origin Authorisation, an ROA, naming the AS numbers allowed to originate it and the longest prefix length they may announce. Validators compare every announcement against those ROAs and mark it valid, invalid or unknown. This page shows that verdict for the prefix you asked about, together with the ROAs themselves. Valid means an ROA covers this exact origin. Invalid means an ROA exists but does not authorise what is being announced — the classic signature of a mis-issued announcement or a genuine hijack, and worth investigating immediately. Unknown, sometimes called not-found, means no ROA covers the prefix at all: common, not yet a failure, but an open invitation the prefix holder should close.
Related tools: the DNS propagation checker when the name resolves differently in different places, the port scanner when the route is fine but the service is not answering, and the companion guide how to check BGP routes and RPKI for a worked walkthrough of reading paths, visibility and ROA verdicts together.
Data sources and attribution: routing data comes from RIPEstat, the RIPE NCC’s data API, built on the RIPE RIS collectors that peer with networks worldwide and record the announcements they hear; RPKI validation is performed with Routinator against the five regional registries’ trust anchors. Routing data changes by the minute, so results are a snapshot of the moment of the check, cached only briefly, and a prefix can legitimately look different an hour later.
The five facts this page shows
| Origin ASN | The autonomous system number that announces the prefix — the network claiming to be its home in the global routing table. |
| Announced | Whether collectors currently hear any announcement for the prefix at all; an unannounced prefix is unreachable from the public internet. |
| RIS visibility | How many of the RIPE RIS collector peers see the prefix, as a count out of the total reporting — near-total visibility is the healthy norm. |
| AS path | The sequence of autonomous systems an announcement travelled through to reach a collector, read right to left from origin to collector. |
| RPKI status | Whether an ROA authorises the announcement: valid means covered, invalid means an ROA exists but does not permit this origin or length, unknown means no ROA covers it. |
Frequently asked questions
What can I enter — an IP, a prefix or an ASN?
All three. A single IP address is mapped to the prefix that covers it and that prefix is looked up. A CIDR prefix such as 1.1.1.0/24 is looked up directly. An AS number such as AS13335 returns the network’s holder name, how many prefixes it announces, a sample of them, and its upstream, downstream and total neighbour counts.
My prefix shows as not announced. What does that mean?
No RIS collector currently hears an announcement for it, so the public internet has no route to it. Common causes are a router or session problem at the origin, an announcement filtered by an upstream, a very recent change that has not spread yet, or simply querying a block that is allocated but not in use. Check the origin router’s BGP sessions first, then ask the upstream whether they accept and propagate the prefix.
RPKI says invalid. Is my prefix hijacked?
Invalid means an ROA covers the prefix but does not authorise the announcement being seen — the origin AS is not listed, or the announced prefix is longer than the ROA’s maximum length. The most common cause is operational, not malicious: a new origin or a more-specific announcement was deployed without updating the ROA. Fix or republish the ROA if the announcement is yours and intended; if the origin AS is not yours at all, treat it as a possible hijack and contact the prefix holder and your upstreams urgently.
Why is visibility less than the total number of peers?
Some collectors peer with networks that never carry this route — a prefix announced only regionally, one filtered by policy, or one so new it has not reached every session yet. A small shortfall is normal, especially for IPv6 and for more-specific prefixes. Visibility near zero for a prefix that should be global is the warning sign: the announcement is leaving the origin but not spreading.
How fresh is this data, and is it cached?
RIPEstat aggregates RIS collector data continuously, and this page reads it live at check time through sysosx’s checker, which caches a result only briefly to stay within polite request limits — a cached answer is labelled as such. Route changes can take minutes to appear in collector data even when they have already taken effect for real traffic, so re-check shortly after making a change rather than treating one snapshot as final.