BGP map, looking glass or traceroute: which one to use
A BGP map, a looking glass and a traceroute all show how traffic reaches an address, and they answer different questions. The first two read routes. Traceroute follows packets.
A BGP map: what many networks announce
A map is built from route collectors. The RIPE RIS collectors keep BGP sessions with many networks and record the routes those networks send them. For one prefix, the collectors therefore hold one AS path per peer, and a map draws them together.
That makes it the right tool for questions about the announcement: which AS is the origin, which networks sit above it, how many of the peers agree, and whether the answer changed. It does not show what any single router does, and it only sees networks that peer with a collector.
A looking glass: one network's own view
A looking glass is a web page or a command line that an operator exposes so outsiders can query one of its routers. A command such as show ip bgp 1.1.1.0/24 prints the routes that router has for the prefix and the attributes on them: local preference, communities, the next hop and which route it picked.
Use it for the question a map cannot answer: why does this network send traffic this way. It is also the only place you see the attributes that operators set for themselves. Its limits are the reverse of the map's. It has one vantage point, it shows only what that operator allows, and the commands are restricted.
Traceroute: where packets go
Traceroute sends packets with a rising time to live and records which router answers at each step. It describes the data plane, what packets really do, instead of what BGP announced.
It is the tool for latency and loss, since each hop has a time next to it. But it prints router addresses, not AS numbers, so you have to map each address to a network yourself, and several things blur the result: addresses on an exchange point belong to the exchange, MPLS tunnels hide hops inside a network, routers often answer slowly or not at all, and load balancing can send different probes along different paths. The way back is a different path from the way there, and traceroute only shows one direction.
Which one for which question
| Question | Start with |
|---|---|
| Who announces this prefix, and through whom? | A BGP map |
| Did the origin or the upstreams just change? | A BGP map, and a stored history for anything older |
| Why does network X prefer this route? | A looking glass at network X |
| Where does the latency or the loss start? | Traceroute (or mtr), run from the affected side |
| Is the prefix reachable from outside at all? | A map for the announcement, then pings and traceroutes from several places |
Using them together
Say a site is slow from one provider. Run a traceroute from that provider's side and note the network where the time jumps. Open the destination's prefix on a map to see which paths exist and which networks it uses upstream. Then ask a looking glass in the suspect network which route it picked and why. Each step narrows what the next tool has to answer.
Why a map and a traceroute can disagree
An AS path is a list of networks, drawn from announcements. A traceroute is a list of routers, drawn from packets. A network can hide several routers behind one MPLS tunnel, an exchange point adds an address that belongs to nobody on the path, and traffic engineering inside a network can send packets by a different route from the one its announcements suggest. When they disagree, the announcement tells you what was intended and the traceroute tells you what happened.
See how to read a BGP map for the drawing itself, or open a real one: 1.1.1.0/24. The collectors behind it are described at RIPE RIS.
More guides
- How to read a BGP mapWhat the boxes, arrows, numbers and colours on a map mean.
- How to find the upstream providers of a networkReading transit providers from AS paths, and what the shares mean.
- Which network announces an IP address?From an address to its prefix and origin AS, and when whois disagrees.
- What is an AS path?How the AS path is written and used, and what prepending does.
- Tier 1 networksThe transit-free networks, with a link to each one's map.
- Origin, upstream and peer: who is who on a BGP mapThe roles networks play on a path, and why peers hide.
- How to spot a BGP hijack on a mapThe signs of a hijack in route data, and the harmless look-alikes.