Which data sources are commonly used to analyze past BGP incidents?

• A. RouteViews, RIPE RIS, BGPmon, Looking Glass, and public incident reports.
• B. Only live traffic samples.
• C. DNS caches.
• D. Firewall logs.

Answer: (A)

When analyzing past BGP incidents, you want sources that capture how routes were advertised and changed over time across many networks. RouteViews and RIPE RIS are archives of BGP route views from numerous collectors around the world, providing historical snapshots of the global routing table and updates. They let you see when a prefix appeared or disappeared, and how the AS path shifted during an event. BGPmon adds detection capabilities and historical context for anomalies and hijacks, so its data helps identify when something abnormal occurred and what may have driven it. Looking Glass portals from networks offer a network’s own perspective on routes at specific times, which helps corroborate details like which path was used and how it looked from a particular vantage point. Public incident reports document known events with timelines, impact, and analysis, giving you validated narratives and specifics to compare against your data.

Together, these sources provide a robust, cross-checked view of past incidents: large-scale historical routing data, anomaly-focused observations, device-level perspective, and documented case studies. In contrast, relying only on live traffic samples wouldn’t yield the historical context needed to reconstruct an event, DNS caches aren’t focused on BGP routing, and firewall logs don’t capture the full BGP route dynamics or provide a global view of announcements.