Skip to content

bgpipe: BGP pipeline processor

bgpipe is an open-source tool that processes BGP messages through a pipeline of composable stages - bridging the gaps between monitoring and control.

Usually, bgpipe sits between routers as a transparent proxy, auditing, filtering, and transforming BGP sessions on the fly. The same pipeline works on MRT archives, BMP feeds from your routers, and live streams from RIPE RIS and RouteViews. Built on the bgpfix library, written in Go, and distributed under the MIT license. Started in 2023 as part of a research project at the Polish Academy of Sciences.

  sources               processors                      sinks
  listen   ─┐                                       ┌─▶  connect
  read      │   grep · rov · aspa · limit · update  │    write
  ris-live  ├─▶   tag · exec · pipe · metrics     ──┤    stdout
  rv-live   │                                       │    websocket
  bmp      ─┘                                       └─▶  bmp --write

Each stage does one thing; chain them with --. Messages flow in both directions, so the very same pipeline can sit inside a live BGP session.

Quick Demo

Stream live from RIPE RIS, add RPKI validation on the fly, and show RPKI-invalid announcements:

$ docker run --rm ghcr.io/bgpfix/bgpipe:latest -o \
    -- ris-live \
    -- rov --invalid=keep \
    -- grep 'tag[rov/status] == INVALID'

Sample output: 

[
    "R",
    10843,
    "2026-02-10T12:47:02.900",
    "UPDATE",
    {
        "reach":["201.49.180.0/23","201.49.181.0/24"],
        "attrs":{
            "ORIGIN":{"flags":"T","value":"IGP"},
            "ASPATH":{"flags":"T","value":[199524,174,52320,53062,262907,262907,262907,262907,262907,52900,273801]},
            "NEXTHOP":{"flags":"T","value":"196.60.9.188"}
        }
    },
    {
        "PEER_IP":"196.60.9.188",
        "PEER_AS":"199524",
        "COLLECTOR":"rrc19",
        "RIS_HOST":"rrc19.ripe.net",
        "RIS_ID":"196.60.9.188-019c479748f40019",
        "rov/201.49.180.0/23":"INVALID",
        "rov/201.49.181.0/24":"INVALID",
        "rov/status":"INVALID"
    }
]

More one-liners:

# convert an MRT archive to JSON, straight from RIPE RIS (or RouteViews) URL
$ bgpipe read https://data.ris.ripe.net/rrc01/latest-update.gz | head

# stream a full RIB snapshot as BGP updates, keeping one peer's view
$ bgpipe -o -- read https://data.ris.ripe.net/rrc01/latest-bview.gz \
    -- grep 'tag[PEER_AS] == "8218"'

# proxy a BGP session, dump messages to stdout, withdraw RPKI-invalid prefixes
$ bgpipe -o -- listen --peer 198.51.100.7 :179 -- rov -- connect --wait listen 192.0.2.1

# BMP station: collect from your routers, keep post-policy routes, archive as MRT
$ bgpipe -- bmp --listen --peer 192.0.2.0/24 :11019 \
    -- grep 'tag[BMP_RIB] == in-post' -- write --every 15m 'bmp.$TIME.mrt.gz'

# turn RIPE RIS Live into a BMP feed for your own collector
$ bgpipe -- ris-live -- bmp --write collector.example.net:11019

Install

docker pull ghcr.io/bgpfix/bgpipe:latest

wget -O bgpipe \
    https://github.com/bgpfix/bgpipe/releases/latest/download/bgpipe-linux-amd64
chmod +x bgpipe

go install github.com/bgpfix/bgpipe@latest

A single static binary, no dependencies - see the Quick Start for details and other platforms.

Use Cases

  • BGP Firewall

    Drop-in proxy with RPKI ROV + ASPA validation, prefix limits, and rate limiting

  • Full JSON Translation

    Bidirectional BGP <-> JSON including Flowspec - pipe through jq, Python, anything

  • MRT Processing

    Read, convert, and filter compressed MRT archives at scale - update dumps and full RIB snapshots alike

  • Scriptable Pipeline

    Chain stages or pipe messages through external programs

  • Live BGP Monitoring

    Stream from RIPE RIS Live or RouteViews with real-time filters

  • BMP Station & Exporter

    Collect BMP from your routers, or turn any session, archive, or feed into BMP

  • Secure Transport

    Add TCP-MD5 to sessions, proxy over encrypted WebSockets

  • Fast & Hardened

    ~1M messages/s, zero-allocation parsing, fuzzed parsers, and safe defaults

Features

  • Fast - UPDATE parsing in ~175 ns with zero allocations; ~1M messages/s from MRT to JSON on one box
  • Hardened - all parsers are fuzzed: malformed input from a peer or a public feed can't crash the process
  • Safe by default - peer allow-lists, authenticated servers, and slow clients can never stall a session
  • Interop-tested - every change runs against GoBGP, BIRD, FRR, NLnet Labs Rotonda, and FastNetMon Netom
  • Transparent proxy - with TPROXY mode, invisible even at the IP layer: no router reconfiguration
  • RPKI - origin validation (rov, RFC 6811) and route leak detection (aspa, IETF draft-29) - before router vendors ship it
  • Route policy - prefix and rate limits; AS_PATH, community, MED, LOCAL_PREF and ORIGIN rewrites with update
  • Every format - JSON (incl. Flowspec), MRT updates and RIB dumps, BMP, OpenBMP, ExaBGP, and raw BGP; gzip/bzip2/zstd; files, URLs, and pipes
  • BMP - a station and exporter over TCP or TLS: ADD-PATH per address family, RIB views, Peer Up/Down events, and statistics as metrics
  • Glue - a concise filter language, message tags, external programs, WebSockets, TCP-MD5, and config files
  • Observable - live dashboard, Prometheus metrics, health checks, and pprof over the HTTP API
  • 22 stages - composable building blocks, each doing one thing well (full list)

Project

bgpipe is hosted on GitHub under the MIT license, built on the bgpfix library.