What is a BGP Looking Glass?
A Looking Glass server is a network telemetry utility operated by Internet Service Providers (ISPs), backbone carriers, and network engineers. It allows external operators to peer directly into core BGP routing tables to inspect how traffic flows across international transit boundaries, identify packet loss points, and diagnose routing misconfigurations.
How the Global BGP Routing Mesh Operates
The global Internet is composed of over 100,000 Autonomous Systems connected in an intricate peering and transit graph. Networks establish BGP sessions via TCP port 179 to advertise reachability using two primary business relationships:
- Transit Agreements: A customer network pays a Tier-1 or Tier-2 upstream provider (such as Lumen, Telia/Arelion, NTT, or Tata Communications) to carry its packets to every destination on the global Internet.
- Settlement-Free Peering: Two networks of comparable traffic volume connect directly at Internet Exchange Points (IXPs) to swap mutual customer traffic at zero cost.
RPKI: Defending Against BGP Hijacks
Historically, BGP was designed based on implicit trust, making it vulnerable to accidental route leaks and deliberate state-level hijacking. Resource Public Key Infrastructure (RPKI) introduces cryptographic verification by binding an IP prefix to an authorized Autonomous System Number via Route Origin Authorizations (ROAs). Routers drop invalid routes automatically, shielding traffic from interception.
Frequently Asked Questions
What is a Tier-1 Internet backbone provider? +
A Tier-1 carrier is a global network that can reach every other network on the Internet entirely through settlement-free peering, without purchasing transit from anyone else. Prominent Tier-1 backbones include Lumen (AS3356), Arelion (AS1299), NTT (AS2914), AT&T (AS7018), and Tata Communications (AS6453).
Can I query an IP address instead of an ASN? +
Yes. Entering any public IPv4 or IPv6 address will automatically resolve the originating BGP Autonomous System, its routing prefix mask, and issuing Regional Internet Registry (RIR).
Border Gateway Protocol (BGP) & Looking Glass Diagnostic Architecture
The Border Gateway Protocol (BGP-4 - RFC 4271) is the core exterior gateway protocol that binds the global Internet into a unified mesh. Operating as a path-vector routing protocol over TCP port 179, BGP manages how data packets traverse thousands of independently operated Autonomous Systems (ASes) operated by Tier-1 transit providers, regional ISPs, content delivery networks (CDNs), and enterprise datacenters.
1. Purpose and Functionality of a BGP Looking Glass
A Looking Glass is an administrative routing diagnostic interface that provides external visibility into a core router's internal BGP Routing Information Base (RIB). Network engineers and systems architects utilize Looking Glass servers to:
- Verify Prefix Propagation: Confirm that newly allocated IP prefixes are advertised globally without being dropped by upstream transit peer filters.
- Inspect AS-Path Prepending: Analyze how autonomous systems manipulate route preference by artificially inflating the AS-Path attribute.
- Diagnose BGP Route Flapping & Dampening: Identify unstable network links that cause continuous route withdrawal and re-announcement.
- Investigate BGP Route Hijacks: Detect unauthorized rogue announcements of enterprise IP blocks resulting from misconfigurations or malicious interception.
2. Core BGP Path Attributes
BGP path selection does not rely solely on hop count or physical latency. Instead, routers evaluate standardized path attributes in strict sequence:
- Weight: Proprietary internal router preference (Cisco/Juniper); higher weight takes precedence locally.
- Local Preference (LOCAL_PREF): Communicates outbound route preference across internal iBGP peers within an autonomous system (default 100).
- AS-Path Length: Number of unique Autonomous Systems the packet must traverse; shorter AS paths take priority.
- Origin Type: IGP (Internal), EGP (Exterior), or Incomplete (redistributed).
- Multi-Exit Discriminator (MED): Metric suggested to external peers for choosing entry points into an adjacent AS.
3. Modern BGP Security: RPKI & ROA Validation
Resource Public Key Infrastructure (RPKI) applies cryptographic verification to BGP route announcements. Through Route Origin Authorizations (ROAs) signed by regional internet registries, routers cryptographically validate whether the originating AS is legally authorized to advertise the specific IP prefix, neutralizing catastrophic BGP route hijacking.