September 2, 2026

Using a BGP Looking Glass When Traffic Takes a Wrong Turn

Ping from your desk only proves your desk. A looking glass answers a different question: what path does the global table think exists toward this prefix from collectors that are not you.

What a looking glass is

A looking glass is a view into someone else’s routing table. On bgplookup.io Looking Glass that view is built from global RIS-style collectors: AS paths and next hops toward a prefix, not a screenshot of your home router.

You use it when the complaint is geographic. “Works in Ohio, fails in Singapore.” “Fine on LTE, dead on the office fiber.” Application dashboards will not show an AS path. A looking glass will.

A short workflow

1. Resolve the failing name to an address, then to a covering prefix via IP Lookup.
2. Query that prefix on the looking glass.
3. Note origin ASN, path length, and whether collectors agree the prefix exists.
4. If the prefix is gone everywhere, suspect withdrawal or a filter.
5. If it is gone in one region only, suspect a leak, a peer down, or a community that scoped the announcement.
6. Confirm forwarding with Traceroute and Ping from more than one probe.

How to read an AS path without folklore

Left to right, the path is usually listed from observer toward origin, or the reverse depending on the glass. Read the documentation on the page and stay consistent. The last ASN should be the origin. Loops (the same ASN repeating in a way policy did not intend) and sudden extra prepends are clues. Prepends are a volume knob, not a bug, unless they appeared today.

Next hop tells you which neighbor the collector would use. A next hop in an unexpected city can explain extra latency even when the origin ASN looks correct.

Looking glass vs traceroute

Looking glass is control plane: what routers believe. Traceroute is data plane: where packets went, with ICMP quirks and missing hops. Use both. A perfect path in the glass plus a traceroute that dies at a middle AS is often an ACL, uRPF, or MTU problem, not a missing announcement.

Pick a destination that works. Save the typical AS paths from two continents. When it breaks, you will have a baseline instead of a guess.

Build a tiny baseline before the incident

Pick five prefixes you care about: your own, your DNS, your SaaS IdP, your payment processor, and one CDN that fronts your site. Twice a year, save looking-glass paths from two regions and the origin ASN from BGP Lookup. Incidents feel chaotic because nobody knows what “normal” printed as last month. A text file beats a war room argument.

Reading AS_PATH like a sentence

Left-to-right conventions vary by tool; know whether you are seeing origin-last or origin-first. Repeated ASN tokens are prepends, a volume knob. A path that suddenly includes a transit provider your peer never used is a leak candidate. A path that disappears on one collector while ping still works from that city means the collector is not the network your users ride.

When the glass is the wrong first click

If the complaint is local Wi-Fi, stay on the LAN. If the prefix is only meant to live on a private interconnect, public collectors will look empty while the partner path still works. Confirm the prefix is supposed to be default-free before you treat absence as an outage. Run IPv6 as a separate query; policy often diverges by family.

FAQ

FAQ

Why do collectors disagree?

Different peers, different policy, different default-free views. Disagreement is data.

Can a looking glass show my private RFC1918 route?

No. Public collectors see public prefixes.