---
name: "bgplg"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/bgplg"
---

# bgplg(8)

looking glass for the OpenBSD Border Gateway Protocol daemon

## NAME

**bgplg** – looking glass for the OpenBSD Border Gateway Protocol daemon

## SYNOPSIS

**bgplg**

## DESCRIPTION

The **bgplg** CGI program is a looking glass for the [bgpd(8)](/bgpd/8.md) Border Gateway Protocol daemon. The looking glass will provide a simple web interface with read-only access to a restricted set of [bgpd(8)](/bgpd/8.md) and system status information, which is typically used on route servers by Internet Service Providers (ISPs) and Internet eXchange points (IXs). It is intended to be used in a [chroot(2)](/chroot/2.md) environment in */var/www*.

**bgplg** is disabled by default. It requires four steps to enable the looking glass:

1. Update the file permission mode to allow the execution of the **bgplg** CGI program and the additional statically linked programs that have been installed into the [chroot(2)](/chroot/2.md) environment.

   For example, to allow execution of **bgplg** and the statically-linked version of [bgpctl(8)](/bgpctl/8.md):

   ```
   # chmod 0555 /var/www/cgi-bin/bgplg
   # chmod 0555 /var/www/bin/bgpctl
   ```

   External commands like [ping(8)](/ping/8.md) and others will be hidden from the looking glass command list unless given the correct permissions. See the FILES section below for the list of installed programs.

2. The programs [ping(8)](/ping/8.md), [ping6(8)](/ping6/8.md), [traceroute(8)](/traceroute/8.md) and [traceroute6(8)](/traceroute6/8.md) will require a copy of the resolver configuration file [resolv.conf(5)](/resolv.conf/5.md) in the [chroot(2)](/chroot/2.md) environment for optional host name lookups.

   ```
   # mkdir /var/www/etc
   # cp /etc/resolv.conf /var/www/etc
   ```

3. Start the Border Gateway Protocol daemon with a second, restricted, control socket that can be used from within the [chroot(2)](/chroot/2.md) environment. See [bgpd.conf(5)](/bgpd.conf/5.md) for more information.

   For example, add the following to */etc/bgpd.conf* to have [bgpd(8)](/bgpd/8.md) open a second, restricted, control socket:

   ```
   socket "/var/www/run/bgpd.rsock" restricted
   ```

4. Start the [httpd(8)](/httpd/8.md) and [slowcgi(8)](/slowcgi/8.md) servers after configuring the related **server** section in [httpd.conf(5)](/httpd.conf/5.md). For example:

   ```
   ext_addr="0.0.0.0"
   server "lg.example.net" {
   	listen on $ext_addr port 80
   	location "/cgi-bin/*" {
   		fastcgi
   		root ""
   	}
   }
   ```

## FILES

- */var/www/conf/bgplg.css*

  Optional **bgplg** CSS style sheet.

- */var/www/conf/bgplg.head*

  Optional **bgplg** HTML header.

- */var/www/conf/bgplg.foot*

  Optional **bgplg** HTML footer.

- */var/www/run/bgpd.rsock*

  Position of the second, restricted, control socket of [bgpd(8)](/bgpd/8.md).

The following statically linked executables have been installed into the [chroot(2)](/chroot/2.md) environment of the [httpd(8)](/httpd/8.md) server. To enable the corresponding functionality, use the [chmod(1)](/chmod/1.md) utility to manually set the file permission mode to 0555 or anything appropriate. Some of these executables need the set-user-ID bit, so they should be mounted on a filesystem without the **nosuid** option.

- */var/www/cgi-bin/bgplg*

  The **bgplg** CGI executable.

- */var/www/bin/bgpctl*

  The [bgpctl(8)](/bgpctl/8.md) program used to query information from [bgpd(8)](/bgpd/8.md)

- */var/www/bin/ping*

  The [ping(8)](/ping/8.md) program used to send ICMP ECHO\_REQUEST packets to network hosts. Requires the set-user-ID bit, set the permission mode to 4555.

- */var/www/bin/ping6*

  The [ping6(8)](/ping6/8.md) program used to send ICMPv6 ICMP6\_ECHO\_REQUEST packets to network hosts. Requires the set-user-ID bit, set the permission mode to 4555.

- */var/www/bin/traceroute*

  The [traceroute(8)](/traceroute/8.md) program used to print the route packets take to network hosts. Requires the set-user-ID bit, set the permission mode to 4555.

- */var/www/bin/traceroute6*

  The [traceroute6(8)](/traceroute6/8.md) program used to print the route packets take to [inet6(4)](/inet6/4.md) network hosts. Requires the set-user-ID bit, set the permission mode to 4555.

## SEE ALSO

[bgpctl(8)](/bgpctl/8.md), [bgpd(8)](/bgpd/8.md), [bgplgsh(8)](/bgplgsh/8.md), [httpd(8)](/httpd/8.md), [slowcgi(8)](/slowcgi/8.md)

## HISTORY

The **bgplg** program first appeared in OpenBSD 4.1. The initial implementation was done in 2005 for DE-CIX, the German commercial internet exchange point.

## AUTHORS

The **bgplg** program was written by Reyk Floeter ⟨*reyk@openbsd.org*⟩.

## CAVEATS

To prevent commands from running endlessly, **bgplg** will kill the corresponding processes after a hard limit of 60 seconds. For example, this can take effect when using [traceroute(8)](/traceroute/8.md) with blackholed or bad routes.