How this works

Every eight hours the service downloads a full table dump from the RIPE RIS collector rrc00, which peers with over a hundred networks around the world. The dump is an MRT TABLE_DUMP_V2 file of about four gigabytes, holding each peer's complete view of the internet.

It is parsed in one pass. For every prefix the service records which AS originates it, how many of the collector's peers carry that route, and one representative AS path. Every adjacent pair of ASes on every path is counted, which is what the peering and transit relationships are built from.

This is an observation, not a statement of fact. A route that no peer of this one collector carries will not appear here even though it exists, and a prefix seen by two peers out of a hundred is far more likely to be a leak than a real announcement. The "peers seeing it" count is shown on every route for exactly that reason.

Nobody publishes who pays whom, so upstream, peer and downstream have to be inferred. Where CAIDA publishes a relationship, this site uses it and labels it as such.

For the rest the rule is positional: on a path from the collector to the origin, an AS that consistently appears before another is probably its provider, and a pair that appears in both directions in comparable numbers is probably a peering. Those are marked inferred and a fair number of them are wrong. Treat them as a starting point, not as evidence.

The customer cone is the number of ASes reachable through a network as its customers, transitively. It is the usual way of ranking how much of the internet depends on one operator.

Validated ROA payloads come from Cloudflare's public rpki-client output, refreshed every four hours. Each route is graded by RFC 6811 origin validation: valid when a ROA authorises that origin for that prefix length, invalid when a ROA covers the prefix but authorises something else, and no ROA when nothing covers it.

"No ROA" is not a failure. A large part of the table is still unsigned.

Registry data -- which RIR holds an AS number, which country it is registered in, when it was allocated, and who holds address space that nobody announces -- comes from the five RIRs' daily delegated-extended statistics files. AS names come from bgp.tools, and organisation names from CAIDA.

Exchange points and membership come from PeeringDB, which networks maintain about themselves, so it is only as complete and as current as each operator has chosen to make it.

The live feed is RIPE's RIS Live stream. The service keeps the recent updates in memory for the feed and writes only the changes worth keeping: a prefix appearing for the first time, or the AS originating it changing.