Every prefix announced in the global routing table.
Each IPv4 and IPv6 prefix seen in global BGP, with the AS that originates it, how many collectors observe it, and its RFC 6811 RPKI validation state. Prefixes announced by more than one origin are kept, one row per origin, so multi-origin announcements and possible hijacks stay visible. Rebuilt daily.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ.
| prefix | family | origin_asn | peer_count | rpki_status | first_seen |
|---|---|---|---|---|---|
| 1.0.0.0/24 | 4 | 13335 | 17 | valid | 2026-10-02 |
| 24.116.251.0/24 | 4 | 11492 | 17 | not_found | 2026-10-02 |
| 85.107.128.0/17 | 4 | 9121 | 17 | valid | 2026-10-02 |
| 113.29.101.64/27 | 4 | 3356 | 1 | not_found | 2026-10-02 |
| 2a09:8e80::/29 | 6 | 48456 | 20 | valid | 2026-10-02 |
Downloading it from code.
Database API reference →One call gets you the current BGP Route build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("bgp_route_v1")client.database.download("bgp_route_v1", "csvgz", "./bgp_route_v1.csv.gz")sums = client.database.checksums("bgp_route_v1", "csvgz")print(meta.updated, meta.entries, sums["sha256"])
Getting your hands on it.
Teams join BGP Route against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Traffic attribution
Group requests, flows and logs by the prefix and origin AS that announces them.
Route security
Flag prefixes that RPKI marks invalid or that more than one origin announces, which is what a leak or a hijack looks like.
Routing visibility
See how widely each prefix is observed across collectors before you trust a route.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
Why does a prefix appear twice?
It's announced by more than one origin AS, a multi-origin (MOAS) prefix. Each origin gets its own row, because a second origin can be deliberate, as in anycast or a migration, or a leak or hijack.
What does peer_count measure?
How many collector peers saw the prefix with that origin. A widely seen route is established; one seen by a single peer may be local or brand new.
How is rpki_status worked out?
By RFC 6811 route origin validation of each prefix and origin against the published ROAs: valid, invalid:origin, invalid:length or not_found.
How is it different from IP ASN?
BGP Route is the table of announcements. IP ASN flattens it into ranges, one AS per address, for lookups.
How often is it rebuilt?
Daily. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV. It's keyed by prefix and origin, so there is no address lookup to build. Poll the metadata call first and fetch only when the build has changed.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.