Which tools and data sources are commonly used to study historical BGP security incidents?

• A. Packet traces.
• B. DNS logs and web server access logs.
• C. Firewall logs only.
• D. RouteViews, RIPE RIS, BGPmon, Looking Glass, and public incident reports.

Answer: (D)

Studying historical BGP security incidents relies on data that directly captures how routing announcements changed over time across the internet. RouteViews and RIPE RIS are essential because they are large, multi-peer repositories of BGP updates and withdrawals from many networks, providing a time-stamped record of which prefixes were advertised and by whom. Looking Glass services let researchers query how different networks are perceiving routes at particular moments, offering additional perspectives on the routing state from various vantage points. BGPmon adds monitoring and alerting for BGP events, helping to detect and reconstruct incidents with a focus on anomalies and timelines. Public incident reports, including operator write-ups and CERT advisories, give narrative context, confirm specifics like affected prefixes and regions, and help validate findings.

This combination is what makes it possible to piece together how an incident unfolded, when it started, who was involved, and how the routing state evolved across the internet. In contrast, packet traces focus on traffic flow at specific points and don’t provide the global, historical view of BGP announcements; DNS logs and web server logs track domain resolution and application activity, not routing changes; firewall logs capture boundary security events but not the underlying BGP dynamics.