You are here: Home > Analyse > Internet Measurements > RIPE Atlas > Documentation > RIPE Atlas Anchor Services

RIPE Atlas Anchor Services

RIPE Atlas anchors are available as targets for various measurements. RIPE Atlas itself will run scheduled measurements against these, but they are also available for measurements from other hosts and systems. Below you can find a list of services the anchors provide.

A RIPE Atlas anchor runs a number of daemons which are used as targets for probe measurements. Currently the anchors support the following mesurements over IPv4 and IPv6:

  • ping
  • traceroute
  • DNS
  • HTTP and HTTPS


The anchors have been configured with BIND to act as an authoritative DNS server.


Config Value Example
zone dns.FQDN
nsid FQDN
id.server FQDN
version.bind Atlas Anchor 0.1  


The anchors have been created with a special zone with records specifically crafted to result in an ethernet frame matching a specific size on the wire (assuming regular ethernet without vlans etc). The idea of this is that one would be able to detect IP fragmentation issues, specifically with IPv6. The following records are served in this zone:

IPv4 Records (example $ORIGIN set to the RIPE NCC anchor):

484.4 IN TXT Payload
512.4 IN TXT Payload
540.4 IN TXT Payload
1252.4 IN TXT Payload
1280.4 IN TXT Payload
1308.4 IN TXT Payload
1280.4 IN TXT Payload
1472.4 IN TXT Payload
1500.4 IN TXT Payload
1528.4 IN TXT Payload

IPv6 Records (example $ORIGIN set to the RIPE NCC anchor):

464.6 IN TXT Payload
512.6 IN TXT Payload
560.6 IN TXT Payload
1232.6 IN TXT Payload
1280.6 IN TXT Payload
1324.6 IN TXT Payload
1452.6 IN TXT Payload
1500.6 IN TXT Payload
1548.6 IN TXT Payload

The first leaf represents the resulting frame size. The second represents the IP version. Therefore if you request "1500.6 IN TXT", the UDP packet response will be created so that it is 1500 bytes if the answer is delivered over IPv6.


The anchor runs a web server with a custom response handler. This response handler has just one option: size. Example URL:

This asks for a response with a payload of 536 bytes (excluding the JSON wrapping). The parameter can be any integer up to 4096. The response is a JSON structure which looks like the following:

  anchor:  "The FQDN of the anchor",
  client:  "The IP address of the client",
  payload: "payload of X bytes"

We also generate a DANE record for each anchor.


The anchors have been configured with self-signed SSL certificates using 2048 bit keys with an expiration time of 100 years. The expiry is set high in order to avoid having to update the expected certificates in user scripts too often. We don't expect to actually keep the systems running with the same key and certificate until 2112 -- our descendants will let you know about upcoming changes.

DNS Answer Sink

The anchors have been configured to listen on UDP port 15353 for DNS answers. This is used in an experiment to observe reachability of anycasted services.

Periodically, all instances of ( and ( receive queries with query type SOA and query name "." or "", respectively. The NSID OPT bit is set. These queries are being sent with the source IP of the anchor.