Which network announces an IP address?
Every public IP address can be reached because some network announces a prefix that covers it. One lookup finds that prefix and the network behind it, but the answer can differ from whois, and some prefixes have more than one origin.
From an address to a prefix
Routers do not route single addresses. For each packet they pick the most specific announced prefix that contains the destination, a rule called longest prefix match. If 8.8.8.0/24 is announced, traffic to 8.8.8.8 follows that route, even when a larger block covering the same address is announced as well.
Type an address into the search box, 8.8.8.8 for example, and BGP Map asks RIPEstat for the most specific announced prefix that covers it and opens that prefix's map. A hostname works too. It is resolved to its IPv4 address first.
The origin AS
The origin is the last AS number in the path, the network that put the route into BGP. On a map it is the green box, and the first sentence of a prefix page names it. Most of the time it is the network that runs the addresses. Sometimes it is a provider announcing a customer's block from its own AS, because the customer has no AS number of its own.
When whois says something else
Whois answers a different question: who the address block is registered to. BGP shows who announces it right now. The two often differ for ordinary reasons. A hosting company may announce space it leases from someone else, a provider may announce a customer's block, and a company that bought address space may not have updated the registration yet.
A mismatch is still the first thing to look into when a route seems wrong, especially for address space that was quiet for years and suddenly shows up in BGP.
More than one origin
Sometimes two or more networks announce the same prefix. The prefix page then says it is announced by several networks and the map shows more than one green box. This can be planned, for example while a network moves from one provider to another, or when both a customer and its provider announce the customer's block. A hijack or a leaked route looks the same on the map, so check any origin you did not expect.
Checking RPKI
Many address holders publish a Route Origin Authorisation (ROA) in RPKI. A ROA names the AS allowed to announce a prefix and the most specific length it may be announced at. A route from an AS the ROA does not cover, or more specific than it allows, is RPKI invalid, and a growing number of networks drop such routes. RIPEstat shows the RPKI status of any prefix and origin pair.
Small blocks inside a larger route
Ask for a /25 inside an announced /24 and BGP Map takes you to the /24, because that is the route traffic to it follows. Most networks filter IPv4 announcements longer than /24 and IPv6 announcements longer than /48, so smaller pieces rarely reach the collectors at all. A private or reserved address, such as anything in 10.0.0.0/8, is never routed on the public Internet and has no map.
More guides
- How to read a BGP mapWhat the boxes, arrows, numbers and colours on a map mean.
- How to find the upstream providers of a networkReading transit providers from AS paths, and what the shares mean.
- What is an AS path?How the AS path is written and used, and what prepending does.
- Tier 1 networksThe transit-free networks, with a link to each one's map.