Kc Claffy

BGP data collected from operational routers by platforms such as RIPE RIS or RouteViews is essential to address connectivity issues and analyze the global Internet's structure. However, the vast and ever-growing volume of this data makes deriving useful insights challenging: Existing APIs and dashboards offer limited perspectives, while analyzing large archives of MRT files is slow and cumbersome. We present ChatBGP, a domain-specific chatbot that turns plain-English questions about BGP data into Python code that runs swiftly and returns accurate answers. ChatBGP is enabled by four contributions: (i) a measurement study showing that BGP data is highly redundant and therefore highly compressible; (ii) a database scheme that exploits this redundancy to compress BGP data while enabling fast retrieval of specific data elements; (iii) an expressive API that exposes this database through a simple interface; and (iv) a prompt-engineering scheme that guides ChatGPT to synthesize optimized Python code that uses this API to accurately answer user queries, while retrieving only the data needed to answer each query. With ChatBGP, gaining insights into BGP data becomes effortless and significantly faster—e.g., delivering results in seconds instead of hours with existing tools. Network operators can rapidly diagnose connectivity issues, including security threats, researchers can analyze larger datasets while improving reproducibility, and students can engage with BGP monitoring in a more intuitive and interactive way.

BGP communities are widely used by operators to encode routing metadata for traffic engineering, policy enforcement, and operational debugging. However, ≈90% of observed communities lack public documentation, limiting their utility for research and operational analysis. Among these, city-level communities offer valuable geographic insight into routing behavior, yet remain largely untapped. In this paper, we develop a scalable method to infer the geographic meaning of undocumented city communities using BGP data. We validate our approach against a ground truth dataset covering 1,482 city communities and through operator feedback. Applied to data from May 2025, our algorithm infers the locations of 80% of city communities with a precision of 70 km or better. We publish all code and datasets to support reproducibility and further research.

We introduce new tools and vantage points to develop and integrate proactive techniques to attract IPv6 scan traffic, thus enabling its analysis. By deploying the largest-ever IPv6 proactive telescope in a production ISP network, we collected over 600M packets of unsolicited traffic from 1.9k Autonomous Systems in 10 months. We characterized the sources of unsolicited traffic, evaluated the effectiveness of five major features across the network stack, and inferred scanners' sources of target addresses and their strategies.

Malicious actors exploit the DNS namespace to launch spam campaigns, phishing attacks, malware, and other harmful activities. Combating these threats requires visibility into domain existence, ownership and nameservice activity that the DNS protocol does not itself provide. To facilitate visibility and security-related study of the expanding gTLD namespace, ICANN introduced the Centralized Zone Data Service (CZDS) that shares daily zone file snapshots of new gTLD zones. However, a remarkably high concentration of malicious activity is associated with domains that do not live long enough make it into these daily snapshots. Using public and private sources of newly observed domains, we discover that even with the best available data there is a considerable visibility gap in detecting short-lived domains. We find that the daily snapshots miss at least 1% of newly registered and short-lived domains, which are frequently registered with likely malicious intent. In reducing this critical visibility gap using public sources of data, we demonstrate how more timely access to TLD zone changes can provide valuable data to better prevent abuse. We hope that this work sparks a discussion in the community on how to effectively and safely revive the concept of sharing Rapid Zone Updates for security research. Finally, we release a public live feed of newly registered domains, with the aim of enabling further research in abuse identification.