Evidence-led adoption

Use cases for BGPKIT

BGPKIT supports production routing intelligence, incident investigation, and Internet measurement research. Each entry links to the original source and states the specific component and strength of evidence.

Explore deployments Browse research use
Direct deployment
The source describes BGPKIT as part of an operating system or pipeline.
Direct use
The source documents using a BGPKIT tool or dataset for the stated work.
Cites BGPKIT
The source cites BGPKIT but does not report direct use in its evaluation.

Production systems

Publicly documented deployments and integrations that support Internet-scale routing products.

Cloudflare Direct deployment

Cloudflare Radar BGP origin-hijack detection

Cloudflare Radar detects potential BGP origin hijacks and publishes the resulting data through Radar and its APIs.

BGPKIT's role

A dedicated BGPKIT Broker and Parser deployment turns historical RIPE RIS and Route Views MRT archives into BGP message streams as files become available.

“For historical archives, Cloudflare uses a dedicated deployment of BGPKIT Broker and Parser to convert MRT files into BGP message streams.”
BrokerParser
Cloudflare: BGP origin hijack detection system
Cloudflare Direct deployment

Cloudflare Radar route-leak detection

Cloudflare Radar automatically detects route leaks and exposes the events on ASN pages and through a public API.

BGPKIT's role

Cloudflare describes an on-premises BGPKIT Broker for data-file indexing and the BGPKIT Parser Rust SDK for MRT processing in the detection pipeline.

“Cloudflare deployed an on-premises BGPKIT Broker and uses the BGPKIT Parser Rust SDK to process MRT files.”
BrokerParser
Cloudflare: route leak detection with Radar
Cloudflare Direct use

BGP ORIGIN attribute measurement

Cloudflare measured how BGP ORIGIN attributes are altered in propagation using controlled anycast announcements and observations from public collectors and its own network.

BGPKIT's role

BGPKIT parsed UPDATE messages from all public RIPE RIS and Route Views collectors, alongside Cloudflare's border-router BMP data.

“Cloudflare used BGPKIT to parse Update messages from MRT dumps of all public BGP collectors and local BMP data.”
BGPKIT toolkitParser
Cloudflare: BGP ORIGIN attribute manipulation
Cloudflare Direct use

Cloudflare Radar routing API integration

Cloudflare Radar publishes routing statistics, RPKI status, prefix-to-AS information, and routing anomaly data for operators and researchers.

BGPKIT's role

The Radar release presents Monocle's radar subcommands as a command-line integration for Radar routing statistics and prefix-to-AS lookup.

“Cloudflare documents BGPKIT Monocle as an open-source command-line application and demonstrates monocle radar commands against Radar APIs.”
Monocle
Cloudflare: Routing information on Radar

Operational investigations

Reproducible control-plane evidence used to understand incidents and routing anomalies.

Cloudflare Direct use

1.1.1.1 incident investigation

Cloudflare's June 2024 incident analysis explains a combined BGP hijack and route leak affecting reachability of the 1.1.1.1 resolver.

BGPKIT's role

Monocle queries public route collectors to retrieve the observed rogue announcements and reconstruct their propagation evidence.

“With public route collectors and Monocle, Cloudflare searched for the rogue BGP updates.”
Monocle
Cloudflare: 1.1.1.1 incident, June 2024
Cloudflare Direct use

Venezuela route-leak analysis

Cloudflare investigated recurring route leaks involving Venezuela's AS8048 and evaluated whether the observed event was more consistent with poor routing policy than a deliberate interception attempt.

BGPKIT's role

Monocle's as2rel command supplied collector-observation coverage and directional relationship confidence for the AS8048-AS21980 pair.

“Cloudflare used monocle as2rel with BGPKIT's as2rel dataset to assess the provider-customer relationship.”
Monocleas2rel
Cloudflare: BGP anomaly in Venezuela
Cloudflare Direct use

Forged AS_PATH investigation

Cloudflare analyzed forged AS_PATH hijacks and the operational value of enforcing the First AS check on customer and peer sessions.

BGPKIT's role

Monocle retrieves a precisely scoped RIPE RIS UPDATE that supports the analysis of an implausible, forged path.

“Cloudflare uses Monocle to find a BGP UPDATE message related to the hijack.”
Monocle
Cloudflare: Enforcing the First AS

Research

Published work that directly uses BGPKIT tools or data, plus clearly labeled related citations.

Internet Yellow Pages research project Direct use

Internet Yellow Pages

Internet Yellow Pages is an ontology-backed knowledge graph that harmonizes Internet measurement datasets with relationship-level provenance.

BGPKIT's role

The project integrates BGPKIT as2rel, peer-stats, and pfx2as data products, including the daily prefix-to-AS mapping built from RIPE RIS and Route Views.

“The paper's dataset inventory lists BGPKIT as2rel, peer-stats, and pfx2as as integrated sources.”
as2relpeer-statspfx2as
IMC 2024 paper
DFOH research project Direct use

Forged-origin hijack detection

DFOH is a passive system for detecting forged-origin BGP hijacks that can evade origin-only monitoring and route-origin validation.

BGPKIT's role

The researchers collect BGP routes with BGPKIT from selected RIPE RIS and Route Views vantage points to build the observed AS-path evidence used by the detector.

“We collect BGP routes using BGPKIT from 287 RIS and RouteViews vantage points.”
BGPKIT toolkit
USENIX NSDI 2024 paper
ASPA research project Direct use

Post-ROV BGP defense evaluation

The study evaluates ASPA and related defenses against attacks that remain possible after partial adoption of Route Origin Validation.

BGPKIT's role

BGPKIT Parser is used to inspect RIPE RIS and Route Views RIBs for evidence of Only-To-Customer deployment; the central evaluation is BGPy simulation over CAIDA topology data.

“The paper cites BGPKIT Parser for the RIB inspection used in its OTC deployment analysis.”
BGPKIT Parser
NDSS 2025 paper
MVP research project Cites BGPKIT

Most Valuable Points for routing measurement

MVP selects complementary public BGP vantage points to improve measurement coverage and accuracy within a fixed data budget.

BGPKIT's role

The paper cites BGPKIT among tools that accelerate BGP processing, but does not report use of BGPKIT code or data in its core evaluation.

“The paper's bibliography cites BGPKIT; this entry is intentionally labeled as a citation rather than direct adoption.”
BGPKIT toolkit
arXiv paper

Using BGPKIT in your work?

Tell us about the deployment, investigation, or research. We will add externally verifiable examples to this page.

Share a use case