Yevheniya Nosyk

A Day in the Life of RIPE Atlas

Author image
Yevheniya Nosyk
Contributors: Malte Tashiro, Qasim Lone, Robert Kisteleki, Andrzej Duda, Maciej Korczynski

10 min read

0
Article lead image

On any given day, RIPE Atlas generates billions of measurement results, offering a comprehensive view of connectivity and reachability worldwide. This data, collected for over a decade, forms a unique historical record of the Internet. Here, we focus on a single day to show how RIPE Atlas operates in practice.


RIPE Atlas is one of the most widely used Internet measurement platforms, trusted by researchers and operators alike. Powered by a network of volunteers running small measurement devices, it constantly collects data about the topology, connectivity, and reachability of the global Internet. In this blog, we analyse RIPE Atlas as seen on 1 November 2025.

ripe atlas at a glance

A primer on RIPE Atlas

The core components of the platform are RIPE Atlas probes - hardware (or software) devices executing various types of Internet measurements. The RIPE NCC receives applications from potential probe hosts and accepts those that would contribute to the better coverage of the platform. In return, probe owners gain credits that can be used to run custom measurements. As of February 2026, there are 13,421 connected probes.

An anchor is an enhanced probe, executing a large number of measurements and serving as a measurement target for other probes and anchors. To reward hosts for operating anchors, they earn ten times more credits than regular probe hosts. As of February 2026, 974 anchors are connected to the RIPE Atlas platform.

RIPE Atlas measurements are the key units of work performed by probes and anchors. Every device comes with a series of built-in measurements performed towards well-known targets, pre-defined by the Atlas team. At the same time, one can launch custom user-defined measurements via the web interface or the API. Each measurement is defined by its type, participating probes/anchors, targets, and timing. There are currently six supported measurement types, including ping, traceroute, DNS, NTP, TLS, and HTTP.

RIPE Atlas anchors form a distinct group of targets for so-called anchoring measurements. Every anchor receives a ping, a traceroute, and an HTTP GET request from all the other anchors (thus forming a full mesh) and a subset of regular RIPE Atlas probes. They perform a series of measurements between themselves that can serve as a baseline for the state of Internet connectivity.

Choosing a day in the life

RIPE Atlas has been steadily growing since the inception of the platform in 2010. That said, to pick a representative day for our 'day in the life' analysis, we started by focusing on a more recent period of time spanning the last six months of 2025. Figure 1 below presents the number of connected probes and ongoing measurements between July 2025 and January 2026.

Figure 1: Ongoing measurements and active RIPE Atlas probes per day between Jul 1, 2025 and Jan 1, 2026.

Overall, the number of probes remains relatively stable during this period, fluctuating between 13.3K and 14.4K per day. This is not the case for ongoing measurements though, where the numbers range from 46K to 382K. To get a view of how RIPE Atlas operates on an 'average' day, we chose a day where the two metrics did not substantially deviate from the median - namely, 1 November 2025 - for our analysis.

Measurements

To begin our analysis, we start by examining the volume as well as certain defining characteristics of measurements performed with RIPE Atlas on our day of interest. In total, on that day, approximately 14.2K active probes and anchors participated in 196,950 measurements, generating more than 1.5 billion individual results and 1.3 TB of raw data. Let’s analyse these in more detail.

Overview

Table 1 summarises the number of measurements, results, and data generated on 1 November, 2025. The great majority of ongoing measurements (183.8K or 93.3%) were user-defined, most of them being pings (87.9K) and DNS measurements (88K). Anchors contribute to the second largest chunk of active measurements, with three types of measurements (ping, traceroute, and HTTP) performed between anchors themselves. The remaining 223 built-in measurements are preconfigured to run on each connected probe.

Table 1: All the measurements executed, results (in millions), and the data generated (in gigabytes) on November 1, 2025.
Type Measurements Results (M) Size (GB)
Built-in 223 251.83 162.31
Anchoring 12,898 1078.06 910.19
User-defined 183,829 193.16 196.41
Total 196,950 1523 1268.9

Due to the full mesh between all anchors, they lead in the number and size of generated results. Built-ins come second with over 251M results and 162 GB of raw data. Even though only 223 measurements generated them, we recall that they are frequent (running up to every 4 minutes) and scheduled on all the connected probes. User-defined measurements generated the least amount of data, the great majority of those (81.29%) being one-offs.

Who is measuring

We were wondering about the origins of those 183.8K user-defined measurements and wanted to understand how end-users actually use the platform. To that end, we looked at the description field available for each measurement, which - if it didn’t contain the default string provided by the system - we hoped might give a good indication on the nature and context behind each measurement.

Some of the user-defined measurements were, in fact, launched to back up certain RIPE NCC services. For example, DNSMON is behind 4,429 executed measurements that assess the quality of service provided by root servers and selected top-level domains (TLDs). DomainMON (2,930 measurements) is a similar tool that one can set up to monitor nameservers of its own domains.

Focusing on external measurements, there were at least 85,538 DNS tests and pings used to power Cloud Looking Glass - a service tracking the status and availability of selected global cloud providers, such as Fastly, Akamai, and Amazon Web Services. Another 389 pings, traceroutes, and DNS queries with the description of “HE Network Tools Site” are launched from https://bgp.he.net/traceroute/ - a measurement toolkit run by Hurricane Electric. Smaller-scale ping measurement campaigns target the infrastructure of DNS operators, ISPs, content delivery networks (CDNs), and one regional Internet registry, among others.

What is being measured

Next, we assessed the distribution of measurement targets; i.e., the systems being tested. The 92.2K pings were sent towards 5.9K unique hosts, the top 10 seemingly being CDN test endpoints including the one of Cloud Looking Glass. Traceroutes, in turn, were distributed towards 6K destinations, without having any significant outliers.

The most common DNS target was walmart.com, targeted in as many as 12K measurements on the selected day. This was followed by easydns.com (6K measurements) and rage4.com (6K measurements). The two built-in CHAOS zones (namely hostname.bind and version.bind) close the top five target ranking. The few TLS and NTP measurements targeted 472 and 154 unique hosts, respectively, almost always being unique per measurement.

Interestingly, 1,993 user-defined measurements have overlapping types and targets with some of the built-ins. While they generated a negligible number of results (31M) with respect to all produced in a single day, we argue that built-ins could have been used instead.

Probes and anchors

Now let's turn to the platform’s measurement devices and analyse the 13,248 probes and 920 anchors that were connected on 1 November.

Probe longevity

Figure 2 (left) shows that probes have been steadily added to the network since the first days of RIPE Atlas. On our chosen day, we saw 70 probes whose first connection date went all the way back at the beginning in 2010 - meaning these particular probes have been generating invaluable longitudinal data for the last 16 years. The great majority of active anchors joined the system from 2018 onwards, with the oldest one having been running since 2017.

Figure 2: [left] Distribution of the first connection dates of probes and anchors; [right] Distribution of the first connection dates of probes and anchors

Figure 2 (right) complements the analysis by plotting the total uptimes of connected probes and anchors (in days). These findings are consistent with the expected uptimes based on the first connection dates. For example, the few probes first connected in 2010 have a total uptime of over 5.4K days (over 14 years).

The consistent availability of RIPE Atlas probes and anchors highlights the network’s reliability and stability. Probes that have remained connected for extended periods provide essential longitudinal data crucial for historical analysis.

IP connectivity

More than 9% of connected probes are non-public, meaning they don't reveal any information about their underlying IP connectivity. Focusing on public probes only, we find that 6.5K (49.2%) are dual-stack, while the remaining 5.4K (40%) and 113 (0.9%) are IPv4-only and IPv6-only, respectively. Even though anchors are required to have a public IPv6 address we find 70 (8%) which are not dual-stack, lacking IPv6 connectivity.

To further understand the distribution of these vantage points, we computed the number of devices per IP prefix and ASN. We found that regardless of the address family and network granularity, most IP prefixes and ASNs host only a single probe or an anchor. However, anchors are generally better distributed than probes: 97.18% IPv4 prefixes contain just one anchor.

When aggregating the numbers at the AS level, we see some decrease in the diversity: the share of ASes with one anchor is around 86%, and 66% of ASes host only one probe. The long tail reveals significant concentration in a few major ASes, including Deutsche Telekom, Free, Comcast, and Orange. As they are major consumer ISPs, we hypothesise that probes are largely hosted in home networks of volunteers rather than data centres.

Geographical distribution

Overall, the platform has measurement devices in 183 countries worldwide. Figure 3 below shows the distribution.

Figure 3: Number of connected RIPE Atlas probes and anchors per country on November 1, 2025.

Germany and the United States host substantially more vantage points than any other country, together accounting for 28.5% of probes and anchors. At the other extreme, 34 countries only have one probe or anchor. This highlights a strong bias towards Europe and North America, leaving significant room for growth in the underrepresented regions.

Closing thoughts

RIPE Atlas generates over a billion results daily, relying on the shared community infrastructure to constantly measure the Internet. To keep this sustainable and the generated data of high quality, we propose the following guidelines to all those using it:

  • Check before you measure. Browse the collection of built-in, anchoring, or documented user-defined measurements before launching a custom campaign. Someone may already be doing the exact same thing.
  • Avoid common anti-patterns. Reduce the unnecessary load on the platform: prefer one ongoing measurement to many one-offs, do not poll for results more frequently than new ones are generated.
  • Respect volunteers. Do not probe sensitive resources (e.g., censored domains) that would put probe owners at risk.

You can find a wide selection of RIPE Atlas articles on RIPE Labs, showcasing research results and highlighting the platform’s many useful features. And check out our full technical report for the extended analysis and measurement use cases.

0

You may also like

View more

About the author

Author image
Yevheniya Nosyk Based in Grenoble, France

I am a cybersecurity researcher at KOR Labs, where I work at the intersection of DNS operations, large-scale Internet measurements, and network security. I divide my time between academic research and outreach to the operational community, providing analysis and data on real-world deployments. I earned a Ph.D. in Computer Science from Université Grenoble Alpes in 2024.

Comments 0