BGP Looking Glass Servers

Your router only knows one thing: how it reaches the world. It has no idea how the world reaches you.

This is the fundamental blindness of operating on the Internet. Your BGP table shows your view outward—the paths you'd take to reach every prefix. But when users in Tokyo or São Paulo or Frankfurt try to reach your network, they're following completely different paths, chosen by networks you've never seen, based on policies you don't control.

Looking glasses let you borrow eyes from those networks.

Borrowed Eyes

A looking glass is a router that accepts queries from the public. You ask it questions—show me your route to this prefix, ping this address, trace the path to this destination—and it answers from its perspective, not yours.

This matters because the Internet isn't one network. It's thousands of autonomous systems, each making independent routing decisions. Hurricane Electric sees different paths than Cogent. Deutsche Telekom routes differently than NTT. A prefix that's reachable from one network might be invisible from another.

Looking glasses give you visibility into perspectives you couldn't otherwise access.

What You Can Query

BGP Route Lookups show how a network routes to a specific prefix. Enter an IP or CIDR block and see the AS path, origin, communities, and attributes. This reveals which autonomous systems sit between that network and your destination.

Traceroute shows the actual path packets take—each hop, each router, each network boundary crossing. Unlike BGP tables (which show routing decisions), traceroute shows reality: the physical path through the infrastructure.

Ping tests basic reachability. Can this network reach that address? What's the latency? Is there packet loss?

The combination is powerful. BGP tells you how routing should work. Traceroute and ping show how it actually works.

Reading AS Paths

When you query a BGP route, you'll see something like:

Prefix: 8.8.8.0/24
AS Path: 174 15169
Origin: IGP

The AS path reads left to right, from the querying network toward the origin. Here, traffic flows through AS174 (Cogent) to reach AS15169 (Google). The rightmost AS—15169—originated the announcement.

Shorter paths generally mean more direct routing. A path like 3356 15169 (two hops) is more direct than 6939 174 3356 15169 (four hops). But "direct" doesn't always mean "better"—congested direct links can be slower than longer uncongested paths.

Watch for path prepending: repeated ASNs like 65000 65000 65000 15169. Networks artificially lengthen paths to make routes less attractive, steering traffic toward preferred links. It's traffic engineering through controlled inefficiency.

The Power of Multiple Perspectives

One looking glass shows one view. The real insight comes from checking many.

After announcing a new prefix, query looking glasses across different networks and regions. Does everyone see it? Do the AS paths make sense? If a major network doesn't have a route, you've found a propagation problem—maybe a filter, maybe a session issue, maybe intentional policy.

When users in a specific region report problems, use looking glasses in that region. You might find:

• No route at all (the prefix never propagated there)
• A route through an unexpected path (traffic engineering gone wrong)
• Reachability but high latency (congested or suboptimal path)
• Complete blackhole (route exists but traffic disappears)

Different perspectives reveal different problems.

Finding Looking Glasses

Many networks operate public looking glasses:

Hurricane Electric (lg.he.net) provides extensive coverage with a clean interface—often the first place to check.

RIPE RIS and RouteViews are route collectors that peer with hundreds of networks purely to gather BGP data. They show how dozens of networks see a prefix simultaneously.

RIPEstat (stat.ripe.net) combines routing data with historical analysis, showing how routes have changed over time.

Major networks like Google, Cloudflare, and Level3/Lumen operate their own looking glasses, showing how traffic flows through their specific infrastructure.

Detecting Hijacks

The rightmost AS in a path originated the announcement. If you announced 203.0.113.0/24 from AS65001, every looking glass should show AS65001 as the origin.

If you see a different origin AS, something's wrong. Either someone is announcing your prefix (hijacking), or a misconfiguration is leaking routes through unexpected paths. Either way, investigate immediately.

Regular looking glass queries—or better, automated monitoring—catch hijacks before users notice problems.

Asymmetric Routing

Here's something genuinely strange about the Internet: the path from A to B has nothing to do with the path from B to A.

Your traceroute to Google might go through Cogent. Google's traceroute to you might go through Telia. These are independent routing decisions made by independent networks. Neither path implies anything about the other.

This is normal. Asymmetric routing is the default state of the Internet. But it explains why diagnosing problems requires looking from both ends—your view of the outbound path tells you nothing about what's happening inbound.

Limitations

Looking glasses show snapshots, not movies. BGP converges over minutes, sometimes longer. A route change might appear in one looking glass before another. Wait for convergence before concluding that propagation failed.

Looking glasses show routing tables, not traffic. A network might have a route but send very little traffic over it. Conversely, the busiest path might not be visible in routing tables at all (anycast, traffic engineering, private peering).

IPv6 support varies. Many looking glasses focus on IPv4 or require explicit IPv6 queries.

Beyond Point-in-Time Queries

Looking glasses show you now. For ongoing visibility, monitoring services watch BGP continuously:

• BGPStream and RIPE RIS Live provide real-time BGP update feeds
• Cloudflare Radar and Qrator track routing anomalies globally
• BGPmon and similar services alert on origin changes, path shifts, and withdrawals

These catch problems as they happen, not hours later when users complain.