Is this real routing data?

Yes — it's RIPE NCC's RIS Live feed, the same public stream network operators and researchers use to watch global routing in real time.

Does it need an API key?

No. RIS Live is an open, key-less WebSocket; the saver identifies itself politely with a client name and nothing more.

Does it work offline?

No. It's a live stream, so offline the header simply reads connecting and no events arrive.

What's the difference between an announcement and a withdrawal?

An announcement offers a path to a block of IP addresses; a withdrawal takes one back. Big withdrawal spikes often mean an outage, a misconfiguration or a route leak somewhere in the world.

Yes — free, no download, in your browser.

What is an autonomous system number?

It is the globally unique number that identifies an autonomous system, a group of IP prefixes run by one or more operators under a single routing policy. BGP uses these numbers when networks exchange routing information.

What is a route leak?

RFC 7908 defines it as the propagation of routing announcements beyond their intended scope, breaking the routing policies of the sender, receiver or a network on the path. Most leaks arise from accidental misconfiguration, though they can be malicious.

BGP Route Monitor Screensaver

The BGP Route Monitor screensaver streams the real global BGP update firehose from RIPE NCC's RIS Live service — live counters for announcements and withdrawals per second, plus a rolling sample of individual routing events. It's free, needs an internet connection, and ESC exits.

How the BGP Route Monitor screensaver works

The saver opens a WebSocket straight to ris-live.ripe.net from your browser and subscribes to BGP update messages — no key, no server in between.

Every message is a real update seen by one of RIPE's route collectors: an announcement means a network is telling the internet how to reach a block of addresses, a withdrawal means that route just disappeared.

The stream runs at roughly two thousand messages a second, so the counters tally everything received while the list below shows a readable sample of individual events.

Each sampled row shows the prefix and the originating autonomous system number — announcements in white, withdrawals in red.

BGP and how the internet finds its way

The internet is a network of autonomous systems. RFC 1930 defines an autonomous system as a connected group of IP prefixes run by one or more operators with a single, clearly defined routing policy, and each one is identified by a globally unique number, the ASN. The Border Gateway Protocol is how these networks tell each other which prefixes they can reach: each announces what it originates, neighbours pass on what they learn, and routers build their route tables from those announcements.

The RIPE NCC, the regional internet registry for Europe, the Middle East and parts of Central Asia, runs the Routing Information Service (RIS). RIS uses distributed Remote Route Collectors, typically located at Internet Exchange Points, which store the BGP update and withdraw messages they receive from peers. Network operators volunteer to peer with them. RIS Live is the live feed of this data, intended for monitoring BGP messages and spotting routing incidents in near real time. Because every message is seen from the collectors’ peers, it shows a slice of the internet, not every path.

Most updates are routine churn. Occasionally something unusual matters, such as a route leak, which RFC 7908 defines as the propagation of routing announcements beyond their intended scope. Leaks most often arise from accidental misconfiguration, though they can also be malicious. A single announcement in a stream says little; judging an incident needs context about who legitimately holds the prefix.

A worked example

A white row reading A 45.227.82.0/23 — origin AS267070 means AS267070 is advertising that block of addresses right now. When the withdrawals-per-second counter jumps and red rows flood the list, something has gone wrong somewhere on the internet — a cable cut, a router reload, a national shutdown or a route leak — often minutes before it shows up in the news.

Settings & tips

Sampled rows per second sets how many individual events are pulled from the firehose into the readable list; the counters always tally the whole stream.
Withdrawal spikes are the interesting signal — sustained red is usually an outage or a leak, not noise.
It reconnects on its own if the stream drops, and the header reads connecting… until the socket is live.

Frequently asked questions

Is this real routing data?: Yes — it's RIPE NCC's RIS Live feed, the same public stream network operators and researchers use to watch global routing in real time.
Does it need an API key?: No. RIS Live is an open, key-less WebSocket; the saver identifies itself politely with a client name and nothing more.
Does it work offline?: No. It's a live stream, so offline the header simply reads connecting and no events arrive.
What's the difference between an announcement and a withdrawal?: An announcement offers a path to a block of IP addresses; a withdrawal takes one back. Big withdrawal spikes often mean an outage, a misconfiguration or a route leak somewhere in the world.
Is it free?: Yes — free, no download, in your browser.
What is an autonomous system number?: It is the globally unique number that identifies an autonomous system, a group of IP prefixes run by one or more operators under a single routing policy. BGP uses these numbers when networks exchange routing information.
What is a route leak?: RFC 7908 defines it as the propagation of routing announcements beyond their intended scope, breaking the routing policies of the sender, receiver or a network on the path. Most leaks arise from accidental misconfiguration, though they can be malicious.
Where does RIS data come from?: From RIPE NCC’s Remote Route Collectors, typically located at Internet Exchange Points, which store the BGP update and withdraw messages sent by peering networks. RIS Live offers that data as a live feed.

← All Security & Privacy screensavers