BGP Route Announcement Logs
Location
BGP route collectors (RIPE RIS, RouteViews, BGPStream) or edge router BGP logsDescription
Border Gateway Protocol route announcement and withdrawal logs recording prefix announcements, AS path changes, origin AS modifications, and route flapping events from BGP speakers and public route collector projects.
Forensic Value
BGP monitoring detects route hijacking attacks where an attacker announces victim IP prefixes through their own AS to intercept or black-hole traffic. Historical BGP data from route collectors proves when hijacked prefixes were announced and through which AS paths. Unusual origin AS changes for victim IP space indicate BGP hijacking. BGP community tags and AS path prepending patterns help attribute attacks. This data is critical for investigating traffic interception, credential theft via redirected traffic, and BGP-based denial of service.