Origin, upstream and peer: who is who on a BGP map
Every network on an AS path plays a part: it announced the prefix, it sold transit to someone, or it exchanged traffic with a neighbour for free. Knowing which is which explains most of what a map shows, including why some networks never appear on it.
The origin
The origin is the AS that announces the prefix, the last number on every path and the bottom row of a map. It is not always the organisation that uses the addresses. A hosting company may announce a customer's block under its own number, and a protection service may announce a prefix on behalf of a customer for a while. The map shows who announced, and whois or the registry shows who holds.
Upstreams and transit
An upstream sells transit: it carries its customer's traffic to the rest of the Internet and passes the customer's routes on to everyone. The networks drawn directly above the origin are its upstreams. A network usually has two or more, so one failure does not take it off the Internet, and on a prefix page the upstream table shows what share of the collector peers reaches the prefix through each one. How to find the upstream providers of a network explains how far those shares can be trusted.
Peers
Two networks that peer exchange traffic between their own customers, usually without paying each other. Peering is cheaper than buying transit for traffic that would otherwise have to go through a provider, which is why large networks and content networks do it at exchange points and in private links.
Why peers hardly show up on paths
Networks announce routes according to who they came from. A route learned from a customer goes to everyone, since the customer pays for that. A route learned from a peer or a provider goes only to customers. The result, studied by Lixin Gao and Jennifer Rexford in the early 2000s and still a good model of how routes spread, is that a path climbs from customers to providers, crosses at most one peering link at the top, and then descends to customers again.
So a peering link between two large networks can appear near the top of a path, but a peering link between two small networks is invisible to everyone outside them, because neither passes the other's routes onward. Unless a collector sits inside one of those networks it cannot see the link at all. That is the reason public route data lists upstreams well and peers badly, and why a tool built on it cannot give you a complete peer list.
Exchange points do not appear either
Many exchange points run a route server that passes routes between members. By default it does not add its own AS number to the path, as RFC 7947 describes, so two members that peer across an exchange look as if they were directly connected. You will not find the exchange as a box on a map.
The colours on BGP Map
The map marks the role where it can. Violet boxes are the transit-free networks listed in the Tier 1 guide, blue boxes are a hand-kept list of other large transit networks, cyan is any other network in the middle of a path, and white is an edge network. The origin is green and the prefix is amber. The labels come from lists, not from measurement, and the About page says where they are drawn from.
Reading one
Open AS13335 and its largest prefix. The green origin sits at the bottom, a few upstreams are drawn directly above it, and the large transit networks stand higher up. Then look at the Tier 1 networks and open one of their maps to see how a network with no upstream of its own is drawn. The guide to AS paths covers the order the numbers are written in.
More guides
- How to read a BGP mapWhat the boxes, arrows, numbers and colours on a map mean.
- How to find the upstream providers of a networkReading transit providers from AS paths, and what the shares mean.
- Which network announces an IP address?From an address to its prefix and origin AS, and when whois disagrees.
- What is an AS path?How the AS path is written and used, and what prepending does.
- Tier 1 networksThe transit-free networks, with a link to each one's map.
- BGP map, looking glass or traceroute: which one to useWhich tool answers which routing question.
- How to spot a BGP hijack on a mapThe signs of a hijack in route data, and the harmless look-alikes.