External BGP Visibility — 23 Global RIPE RIS Vantage Points

Internal BMP tells you what your routers think they’re announcing. The internet only believes what other people see. RoutePulse closes that gap by consuming the RIPE RIS Live WebSocket stream across 23 global Route Information Service collectors — a worldwide external perspective on how your prefixes actually propagate through the Default-Free Zone. For each prefix, RoutePulse tracks visibility as the percentage of RIS collectors currently seeing your route, and raises a CRITICAL alert the moment visibility drops below 70 %. Origin-AS mismatch detection identifies cases where external collectors observe a different origin than expected — the earliest possible warning for route hijacks, misconfigurations, or upstream filtering accidents.

External visibility complements internal monitoring with a fundamentally different validation surface. If your prefix disappears from the DFZ but your routers still think they’re announcing it, internal monitoring stays green — the only thing that breaks is your customers’ reachability. The 23-collector vantage point catches that immediately. RIS Live runs as a persistent WebSocket connection (low-latency, sub-second propagation observation), the per-prefix Last-Seen trace shows the most recent RIS update timestamp and originating AS_PATH, and a Propagation Trace visualisation surfaces which subset of the 23 collectors currently sees the prefix — making geographic propagation gaps obvious at a glance. Combined with RPKI validation, ASPA route-leak detection, and IRR audit, external visibility delivers the final outside-in security layer that completes RoutePulse’s full-stack routing observability.

23-collector global vantage

RIPE RIS operates 23 collectors at major IXPs worldwide (rrc00 LINX London through rrc26 BCN-IX Barcelona and beyond), each peering with dozens of networks. RoutePulse connects to RIS Live as a persistent WebSocket, filters the firehose down to events touching your prefixes, and maintains per-prefix visibility state in a ring buffer for efficient historical lookup with bounded memory. Sub-second propagation observation is the difference between “we noticed in 30 minutes during the next polling cycle” and “we noticed in the same second the AS_PATH changed”.

Mismatch & hijack detection

For every announced prefix, RoutePulse tracks the expected origin AS and matches every RIS update against it. An external collector observing a different origin AS is the textbook signature of a route hijack — whether malicious BGP attack, BGP-optimizer leak, or fat-finger redistribute. Mismatches are raised as incidents and flow through the 47-playbook MITRE-tagged response engine, with the 8-gate Conviction Engine treating external-mismatch as a strong feature for blackhole eligibility.

Propagation trace & Last-Seen visualisation

Per-prefix views show which of the 23 RIS collectors currently sees the prefix, the AS_PATH each collector observes, and the most-recent update timestamp per collector. Geographic propagation gaps become immediately obvious — a prefix invisible in Asia but fine in Europe is a different problem from one visible everywhere except a specific Tier-1 transit, and RoutePulse surfaces both at a glance. The prefix watchlist lets operators pin business-critical prefixes for higher-frequency monitoring and tighter alert thresholds.

Alert hygiene & integration

Per-prefix alert cooldown prevents notification fatigue during extended instability periods; ring-buffer event storage delivers fast historical lookup without unbounded memory growth; and visibility-drop alerts are correlated with RPKI status, ASPA authorization, IRR records, and recent BMP session events for a unified incident dossier. External visibility data also feeds the Compositional Anomaly Detector (CAD) and the ML ensemble for higher-confidence anomaly scoring.

Key Capabilities

• Real-time prefix visibility monitoring across the DFZ via the RIPE RIS Live WebSocket stream
• 23 global Route Information Service collectors (rrc00 LINX through rrc26 BCN-IX) for worldwide propagation perspective
• Per-prefix visibility percentage tracking with CRITICAL alerts when visibility drops below 70 %
• Origin-AS mismatch detection for route hijacks, misconfigurations, BGP-optimizer leaks, and fat-finger redistribute
• Ring-buffer event storage for efficient historical lookup with bounded memory usage
• Per-prefix alert cooldown preventing notification fatigue during extended instability periods
• Propagation Trace visualisation showing which RIS collectors see the prefix and the AS_PATH each observes
• Last-Seen trace per collector with most-recent-update timestamp and originating AS_PATH
• Prefix watchlist for pinning business-critical prefixes with higher-frequency monitoring and tighter thresholds
• Integration with RPKI validation, ASPA RFC 9234, IRR audit, and BMP session monitoring for unified incident dossiers
• Feeds the Compositional Anomaly Detector (CAD) and 18-model ML ensemble for high-confidence anomaly scoring
• External-mismatch signal consumed by the 8-gate Conviction Engine v2 for blackhole-eligibility decisions
• Continuous outside-in validation closing the gap that internal BMP monitoring alone cannot detect

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →