Querying the DFZ#

Ties de Kock, RIPE NCC

• Why: MRT parsing has always been the barrier to doing your own BGP analysis — most teams default to whatever prebuilt tools offer. RIPE RIS publishing its data as indexed Parquet makes DFZ-scale analysis a SQL problem, which changes what a network team can realistically do for itself.
• What: RIPE RIS BGP RIBs and updates are now published as Parquet files: a daily RIB of ~350M rows (~2.4 GB) and hourly update files (~50M rows, 350–400 MB), with columns for timestamp, prefix, origin AS, peer, AS path, and communities. Query with DuckDB, SQL, or dataframe tools instead of MRT parsers; analyses that previously took 10+ minutes run in seconds. RIPE NCC has already used it operationally — assessing BGP impact of the Baltic Sea cable damage and the Iberian power outage in minutes instead of hours.
• How: Parquet plus DuckDB replaces both custom MRT parsing scripts and expensive database indexing; the schema is designed to be ergonomic for queries and correct for analysis (AS sets are supported rather than flattened away).
• Where applicable: Free and broadly usable by any operator or researcher. Caveat: the short-term archive covers 14 days of RIBs/updates (an 18-month experiment with a go/no-go decision), so deep historical work still goes through MRT files.