You are here: Home > Analyse > Internet Measurements > RIPE Atlas > Documentation > Raw data structure documentation

RIPE Atlas - Raw data structure documentation

RIPE Atlas user-defined measurement (UDM) results—and results from probe measurements—can be downloaded in JSON format. This document describes the data structure of these results, which can vary by probe firmware version.

1. Notes

1.1. Versioning
1.2. Multiple Addresses in a Result

2. Version 1

2.1. Ping / v6 Ping
2.2. Traceroute / v6 Traceroute

3. Version 4400

3.1. Ping / v6 Ping
3.2. Traceroute / v6 Traceroute
3.3. DNS Lookup
3.4. HTTP
3.5. SSL GET Cert

4. Version 4460

4.1. Ping / v6 Ping
4.2. Traceroute / v6 Traceroute
4.3. DNS Lookup
4.4. HTTP
4.5. SSL GET Cert

5. Version 4540

5.1. Ping / v6 Ping
5.2. Traceroute / v6 Traceroute
5.3. DNS Lookup
5.4. HTTP
5.5. SSL GET Cert

6. Version 4570

6.1. Ping / v6 Ping
6.2. Traceroute / v6 Traceroute
6.3. DNS Lookup
6.4. HTTP
6.5. SSL GET Cert

7. Version 4610 (or greater)

7.1. Ping / v6 Ping
7.2. Traceroute / v6 Traceroute
7.3. DNS Lookup
7.4. HTTP
7.5. NTP
7.6. SSL GET Cert

1. Notes

1.1. Versioning

The results are returned as an array consisting of elements, each of which is an associative array. The structure of these associative arrays depends on the firmware version used by the probe conducting the measurement. Therefore, it is possible for downloaded results to contain a mix of different result structures.

The data structure of each result contains the key fw which identifies the firmware version used by the probe that generated that result.

Version 1 is identified by the value "1".
Version 4400 is identified by a value of between "4400" and "4459".
Version 4460 is identified by a value of between "4460" and "4539".
Version 4540 is identified by a value of between "4540" and "4569".
Version 4570 is identified by a value of between "4570" and "4609".
Version 4610 is currently the most recent version of the datastructure documentation. At the moment any value greather than 4570 conforms to the 4570 documentation. An upper limit to this version will added with the release of a firmware version that changes the datastructures.

1.2. Multiple Addresses in a Result

The result structure may contain several different fields that appear to contain similar information, but which are in fact slightly different.

from: This field is added by the RIPE Atlas backend system and is used in ASN lookup, geo-location, and so on. There are some special cases for IPv6-capable probes in which that this can be an empty string.
src: This field is added by the probe. It comes from a TCP socket, or from UDP connect/getsockname calls.

If the probe is behind a NAT, src could be a private address, whereas from will always be a public address.
It is also possible for src and from to differ with IPv6 if there are multiple addresses from RAs and/or static configuration with a different priority.
With v4 addresses, it is possible for the from field to be filled in at a later time, rather than when the measurement was made. If the probe is unable to connect to the RIPE Atlas backend system, but continues performing measurements and delivers the results at a later time, the backend system will populate the from field for this entire 'disconnected' time with the value at the time of reconnection.

2. Version 1

Version 1 is identified by the value "1" for the key fw in the result.

2.1. Ping / v6 Ping

Result:

"addr" -- IP address of the destination (string)
"avg" -- average round-trip time (float)
"dup" -- number of duplicate packets (int)
"from" -- IP address of the probe as known by controller (string)
"max" -- maximum round-trip time (float)
"min" -- minimum round-trip time (float)
"msm_id" -- measurement identifier (int)
"name" -- name of the destination (string)
"prb_id" -- source probe ID (int)
"rcvd" -- number of packets received (int)
"sent" -- number of packets sent (int)
"size" -- packet size (int)
"timestamp" -- Unix timestamp (int)

Example result:

{
    "addr": "178.63.78.16",
    "avg": 20.126000000000001,
    "dup": 0,
    "from": "62.194.83.50",
    "fw": 1,
    "max": 20.300000000000001,
    "min": 19.937999999999999,
    "msm_id": 1000047,
    "name": "atlas.ripe.net",
    "prb_id": 165,
    "rcvd": 3,
    "sent": 3,
    "size": 56,
    "timestamp": 1332938930
}

2.2. Traceroute / v6 Traceroute

Result:

"from" -- IP address of the probe as known by controller (string)
"msm_id" -- measurement identifier (int)
"prb_id" -- source probe ID (int)
"result" -- output of the traceroute command (string)
"timestamp" -- Unix timestamp (int)

Example result:

{
    "from": "2001:67c:2e8:13:220:4aff:fec6:cc1e",
    "fw": 1,
    "msm_id": 6001,
    "prb_id": 21,
    "result": "traceroute to 2001:7fd::1 (2001:7fd::1), 32 hops max, 16 byte packets NEWLINE 1  2001:67c:2e8:13::2  1.907 ms  1.909 ms  1.945 ms NEWLINE  2  2001:7f8:1::a502:5152:1  14.162 ms  2.026 ms  1.872 ms NEWLINE  3  2001:7fd::1  1.876 ms  1.872 ms  1.878 ms NEWLINE",
    "timestamp": 1338816126
}

3. Version 4400

Version 4400 is identified by a value between "4400" and "4459" for the key fw in the result.

3.1. Ping / v6 Ping

Result:

"addr" -- IP address of the destination (string)
"avg" -- average round-trip time (float)
"dup" -- number of duplicate packets (int)
"from" -- IP address of the probe as known by the controller (string)
"max" -- maximum round-trip time (float)
"min" -- minimum round-trip time (float)
"mode" -- "ICMP4" or "ICMP6" (string)
"msm_id" -- measurement identifier (int)
"name" -- name of the destination (string)
"prb_id" -- source probe ID (int)
"rcvd" -- number of packets received (int)
"result" -- variable content, depending on type of response (array)
Each element is an associative array consisting of:
- Case: Timeout
  - "x" -- "*" (string)
- Case: Error
  - "error" -- description of error (string)
- Case: Reply
  - "rtt" -- round-trip-time in milliseconds (float)
  - "ttl" -- [optional] time-to-live reply if different from ttl in first reply (int)
  - "dup" -- [optional] signals that the reply is a duplicate (int)
"sent" -- number of packets sent (int)
"size" -- packet size (int)
"srcaddr" -- source address used by probe (string)
"timestamp" -- Unix timestamp (int)
"ttl" -- time-to-live field in the first reply (int)

Example result:

{
    "addr": "2001:7fd::1",
    "avg": 2.1720000000000002,
    "dup": 0,
    "from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "fw": 4450,
    "max": 2.2869999999999999,
    "min": 2.1000000000000001,
    "mode": "ICMP6",
    "msm_id": 2001,
    "name": "2001:7fd::1",
    "prb_id": 9,
    "rcvd": 3,
    "result": [
      {
        "rtt": 2.2869999999999999
      },
      {
        "rtt": 2.129
      },
      {
        "rtt": 2.1000000000000001
      }
    ],
    "sent": 3,
    "size": 0,
    "srcaddr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "timestamp": 1338814181,
    "ttl": 62
  }

3.2. Traceroute / v6 Traceroute

Result:

"addr" -- IP address of the destination (string)
"endtime" -- Unix timestamp for end of measurement (int)
"from" -- IP address of the probe as know by controller (string)
"mode" -- "ICMP4" or "ICMP6" or "UDP4" or "UDP6" (string)
"msm_id" -- measurement identifier (int)
"name" -- name of the destination (string)
"paris-id" -- variation for the Paris mode of traceroute (int)
"prb_id" -- source probe ID (int)
"result" -- list of hop elements (array)
Each element is an associative array consisting of:
- "hop" -- hop number (int)
- "error" -- [optional] when an error occurs trying to send a packet. In that case there will not be a result structure. (string)
- "result" -- variable content, depending on type of response (array)
  Each element is an associative array consisting of:
  - Case: Timeout
    - "x" -- "*" (string)
  - Case: Reply
    - "from" -- IPv4 or IPv6 source address in reply (string)
    - "rtt" -- round-trip-time of reply (float)
    - "size" -- size of reply (int)
    - "ttl" -- time-to-live in reply (int)
    - "icmpext" -- [optional] information when icmp header is found in reply (object)
      - "version" -- RFC4884 version (int)
      - "rfc4884" -- "1" if length indication is present, "0" otherwise (int)
      - "obj" -- elements of the object (array)
        
        "class" -- RFC4884 class (int)
        
        "type" -- RFC4884 type (int)
        
        "mpls" -- [optional] MPLS data, RFC4950, shown when class is "1" and type is "1" (array)
        
        "exp" -- for experimental use (int)
        
        "label" -- mpls label (int)
        
        "s" -- bottom of stack (int)
        
        "ttl" -- time to live value (int)
"size" -- packet size (int)
"srcaddr" -- source address used by probe (string)
"timestamp" -- Unix timestamp for start of measurement (int)

Example result:

  {
    "addr": "2001:470:c:c35::1:186",
    "endtime": 1338812907,
    "from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "fw": 4450,
    "mode": "UDP6",
    "msm_id": 6020,
    "name": "2001:470:c:c35::1:186",
    "paris-id": 1,
    "prb_id": 9,
    "result": [
      {
        "hop": 1,
        "result": [
          {
            "from": "2001:67c:2e8:13::2",
            "rtt": 2.2829999999999999,
            "size": 96,
            "ttl": 63
          },
          {
            "from": "2001:67c:2e8:13::2",
            "rtt": 2.4590000000000001,
            "size": 96,
            "ttl": 63
          },
          {
            "from": "2001:67c:2e8:13::2",
            "rtt": 2.4209999999999998,
            "size": 96,
            "ttl": 63
          }
        ]
      },

...

      {
        "hop": 7,
        "result": [
          {
            "from": "2001:470:c:c35::1:186",
            "rtt": 140.595,
            "size": 96,
            "ttl": 57
          },
          {
            "from": "2001:470:c:c35::1:186",
            "rtt": 140.19300000000001,
            "size": 96,
            "ttl": 57
          },
          {
            "from": "2001:470:c:c35::1:186",
            "rtt": 139.82900000000001,
            "size": 96,
            "ttl": 57
          }
        ]
      }
    ],
    "size": 40,
    "srcaddr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "timestamp": 1338812898
  }

3.3. DNS Lookup

Result:

"address" -- [optional] IP address of the destination (string)
"error" -- [optional] error message (associative array)
- "timeout" -- query timeout (int)
- "getaddrinfo" -- error message (string)
"from" -- [optional] IP address of the source (string)
"msm_id" -- measurement identifier (int)
"name" -- [optional] hostname of the destination (string)
"pf" -- [optional] IP version: "4" or "6" (int)
"prb_id" -- source probe ID (int)
"proto" -- "TCP" or "UDP" (string)
"qbuf" -- [optional] query payload buffer which was sent to the server, UU encoded (string)
See example code for decoding the value
"result" -- [optional] response from the DNS server (associative array)
- "ANCOUNT" -- answer count, RFC 1035 4.1.1 (int)
- "ARCOUNT" -- additional record count, RFC 1035, 4.1.1 (int)
- "ID" -- query ID, RFC 1035 4.1.1 (int)
- "NSCOUNT" -- name server count (int)
- "QDCOUNT" -- number of queries (int)
- "abuf" -- answer payload buffer from the server, UU encoded (string)
  See example code for decoding the value
- "answers" -- first two records from the response decoded by the probe, if they are TXT or SOA; other RR can be decoded from "abuf" (array)
  Each element is an associative array consisting of:
  - "MNAME" -- domain name, RFC 1035, 3.1.13 (string)
  - "NAME" -- domain name. (string)
  - "RDATA" -- [type TXT] txt value, (string)
  - "RDLENGTH" -- [type TXT] length of RDATA (int). depreciated (4450)
  - "RNAME" -- [if type SOA] mailbox, RFC 1035 3.3.13 (string)
  - "SERIAL" -- [type SOA] zone serial number, RFC 1035 3.3.13 (string)
  - "TTL" -- [type SOA] time to live, RFC 1035 4.1.3 (int)
  - "TYPE" -- RR "SOA" or "TXT" (string), RFC 1035
- "rt" -- [optional] response time in milli seconds (float)
- "size" -- [optional] response size (int)
- "src" -- [optional] the source IP address added by the probe (string)
- "subid" -- [optional] sequence number of this result within a group of results, available if the resolution is done by the probe's local resolver
- "submax" -- [optional] total number of results within a group (int)
"timestamp" -- start time, Unix timestamp (int)

Notes:

If a hostname was provided, both the hostname (name) and the IP address (address) will be in the response.
If an IP address was provided, the name field will not be filled, unless the address which was given differs from the probe's resolution of the address. For instance, if "2001:0DB8:0:0::1" was provided, and the probe resolves it to "2001:0DB8::1", the first value will be returned as the name and the second as the address.
The address field will always be present, except when there is an error.

Example result:

  {
    "address": "193.0.14.129",
    "from": "",
    "fw": 4450,
    "msm_id": 10001,
    "pf": 4,
    "prb_id": 9,
    "proto": "UDP",
    "result": {
      "ANCOUNT": 1,
      "ARCOUNT": 13,
      "ID": 12124,
      "NSCOUNT": 13,
      "QDCOUNT": 1,
      "abuf": "L1yEAAABAAEADQANAAAGAAEAAAYAAQABUYAAQAFhDHJvb3Qtc2VydmVycwNuZXQABW5zdGxkDHZlcmlzaWduLWdycwNjb20Ad+2a8AAABwgAAAOEAAk6gAABUYAAAAIAAQAH6QAAAsAcAAACAAEAB+kAAAQBYsAeAAACAAEAB+kAAAQBY8AeAAACAAEAB+kAAAQBZMAeAAACAAEAB+kAAAQBZcAeAAACAAEAB+kAAAQBZsAeAAACAAEAB+kAAAQBZ8AeAAACAAEAB+kAAAQBaMAeAAACAAEAB+kAAAQBacAeAAACAAEAB+kAAAQBasAeAAACAAEAB+kAAAQBa8AeAAACAAEAB+kAAAQBbMAeAAACAAEAB+kAAAQBbcAewBwAAQABAAfpAAAExikABMB0AAEAAQAH6QAABMDkT8nAgwABAAEAB+kAAATAIQQMwJIAAQABAAfpAAAEgAgKWsChAAEAAQAH6QAABMDL5grAsAABAAEAB+kAAATABQXxwL8AAQABAAfpAAAEwHAkBMDOAAEAAQAH6QAABIA/AjXA3QABAAEAB+kAAATAJJQRwOwAAQABAAfpAAAEwDqAHsD7AAEAAQAH6QAABMEADoHBCgABAAEAB+kAAATHB1MqwRkAAQABAAfpAAAEygwbIQ==",
      "answers": [
        {
          "MNAME": "a.root-servers.net.",
          "NAME": ".",
          "RDLENGTH": 64,
          "RNAME": "nstld.verisign-grs.com.",
          "SERIAL": 2012060400,
          "TTL": 86400,
          "TYPE": "SOA"
        }
      ],
      "rt": 2.6600000000000001,
      "size": 493
    },
    "timestamp": 1338813093
  }

3.4. HTTP

Result:

"from" -- IP address of the probe as known by controller (string)
"msm_id" -- measurement identifier (int)
"prb_id" -- source probe ID (int)
"result" -- results of query (array)
Each element is an associative array consisting of:
- "addr" -- target address (string)
- "bsize" -- size of body in octets (int)
- "dnserr" -- [optional] DNS resolution failed (string)
- "err" -- [optional] other failure (string)
- "header" -- [optional] elements are strings. The last string can be empty to indicate the end of enders or end with "[...]" to indicate truncation (array)
- "hsize" -- header size in octets (int)
- "mode" -- "GET4" or "GET6" or "HEAD4" or "HEAD6" or "POST4" or "POST6" (string)
- "res" -- HTTP result code (int)
- "rt" -- time to execute request excluding DNS (float)
- "srcaddr" -- source address used by probe (string)
- "subid" -- [optional] sequence number of this result within a group of results, when the 'all' option is used without the 'combine' option (int)
- "submax" -- [optional] total number of results within a group (int)
- "time" -- [optional] Unix timestamp, when the 'all' option is used with the 'combine' option (int)
- "ver" -- major, minor version of http server (string)
"timestamp" -- Unix timestamp (int)
"uri" -- request uri (string)

Example result:

{
    "from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "fw": 4450,
    "msm_id": 13023,
    "prb_id": 9,
    "result": [
      {
        "addr": "2001:67c:2e8:22::c100:68b",
        "bsize": 1406,
        "hsize": 263,
        "mode": "GET6",
        "res": 200,
        "rt": 10.66,
        "srcaddr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
        "ver": "1.1"
      }
    ],
    "timestamp": 1338814062,
    "uri": "http://www.ripe.net/favicon.ico"
  }

3.5. SSL GET Cert

Result:

"addr" -- IP address of the destination (string)
"cert" -- results of query (array)
Each element of the array is a string containing a base 64 encoded certificate. Newlines are replaced with "\n"
"from" -- IP address of the probe as known by controller (string)
"msm_id" -- measurement identifier (int)
"name" -- name of the destination (string)
"port" -- port name (string)
"prb_id" -- source probe ID (int)
"srcaddr" -- source address used by probe (string)
"timestamp" -- Unix timestamp (int)

Example result:

{
    "addr": "2a01:4f8:121:30a3::78:16",
    "cert": [
      "-----BEGIN CERTIFICATE-----\nMIIGMTCCBRmgAwIBAgIQCfO+bTlrT/6of7r+Sw5WTzANBgkqhkiG9w0BAQUFADBm\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j\nZSBDQS0zMB4XDTEwMTEwMjAwMDAwMFoXDTEyMTEwNTIzNTk1OVowZTELMAkGA1UE\nBhMCTkwxFjAUBgNVBAgTDU5vb3JkLUhvbGxhbmQxEjAQBgNVBAcTCUFtc3RlcmRh\nbTERMA8GA1UEChMIUklQRSBOQ0MxFzAVBgNVBAMTDmF0bGFzLnJpcGUubmV0MIGf\nMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqhOdAts5iMvuw98IDeh1FCw+xfqu5\nUBLXjbdfmH+3EwYhmFpduN9M8s8CnCC0YC5TsWytgzFPevDQ7QTbNPRMYFjtsBtv\nz4OR+mlN3LoAMKXic7mJazEH5/jQG0I06+dOaXQT7JDGZbBAFV78B0B0QqRRJmoY\n1KbvTGtzqBdoUwIDAQABo4IDXjCCA1owHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUB\nINTeeZlIg/cwHQYDVR0OBBYEFLH8APIsyl0RAI8eXaYwqaY11sfTMC0GA1UdEQQm\nMCSCDmF0bGFzLnJpcGUubmV0ghJ3d3cuYXRsYXMucmlwZS5uZXQwewYIKwYBBQUH\nAQEEbzBtMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wRQYI\nKwYBBQUHMAKGOWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhp\nZ2hBc3N1cmFuY2VDQS0zLmNydDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIw\nADBlBgNVHR8EXjBcMCygKqAohiZodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2Ez\nLTIwMTBoLmNybDAsoCqgKIYmaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL2NhMy0y\nMDEwaC5jcmwwggHGBgNVHSAEggG9MIIBuTCCAbUGC2CGSAGG/WwBAwABMIIBpDA6\nBggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBv\nc2l0b3J5Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAg\nAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBz\nAHQAaQB0AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABo\nAGUAIABEAGkAZwBpAEMAZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABo\nAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBu\nAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBiAGkAbABpAHQAeQAg\nAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAgAGgAZQBy\nAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHSUEFjAUBggr\nBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADggEBABh0uT4bltD5QdFj\nrCSCViuOxPJ4667umtzWFgA/oUYM9D8LkXpPo4A3YPexTf3ssiDzxAhsrFxJRrjh\nC5/j77TvRtKv1OfwXfgeeqluybYMs+LRkjNHNkEA9lsonrZ0gSAIktYneWOVQlCe\nEV20yi0oDCPFnk6rCUNoT/dAhHgUX3Iw2p3Hy/ELst3CvMOjvCpaJVTob4t0rOxS\niOuSC4YAqkP+O0dRoAIGedQ9eqDip6vrqGbK5i1PDo1zh0uOBhvcQ+cRWGnmKv8H\nmUDBFFTB4e81O9wnzRrV0BRaBzkGEe6EcluRNs9VS1wZA/Y/xDggSn8+cOM52vb3\nlQuEV20=\n-----END CERTIFICATE-----",
      "-----BEGIN CERTIFICATE-----\nMIIGVTCCBT2gAwIBAgIQCFH5WYFBRcq94CTiEsnCDjANBgkqhkiG9w0BAQUFADBs\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j\nZSBFViBSb290IENBMB4XDTA3MDQwMzAwMDAwMFoXDTIyMDQwMzAwMDAwMFowZjEL\nMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3\nLmRpZ2ljZXJ0LmNvbTElMCMGA1UEAxMcRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug\nQ0EtMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9hCikQH17+NDdR\nCPge+yLtYb4LDXBMUGMmdRW5QYiXtvCgFbsIYOBC6AUpEIc2iihlqO8xB3RtNpcv\nKEZmBMcqeSZ6mdWOw21PoF6tvD2Rwll7XjZswFPPAAgyPhBkWBATaccM7pxCUQD5\nBUTuJM56H+2MEb0SqPMV9Bx6MWkBG6fmXcCabH4JnudSREoQOiPkm7YDr6ictFuf\n1EutkozOtREqqjcYjbTCuNhcBoz4/yO9NV7UfD5+gw6RlgWYw7If48hl66l7XaAs\nzPw82W3tzPpLQ4zJ1LilYRyyQLYoEt+5+F/+07LJ7z20Hkt8HEyZNp496+ynaF4d\n32duXvsCAwEAAaOCAvcwggLzMA4GA1UdDwEB/wQEAwIBhjCCAcYGA1UdIASCAb0w\nggG5MIIBtQYLYIZIAYb9bAEDAAIwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3\nLmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUH\nAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQBy\nAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBj\nAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAg\nAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQ\nAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBt\nAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBj\nAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBl\nAHIAZQBuAGMAZQAuMA8GA1UdEwEB/wQFMAMBAf8wNAYIKwYBBQUHAQEEKDAmMCQG\nCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSBhzCB\nhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFz\nc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQu\nY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSMEGDAW\ngBSxPsNpA/i/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUBINTe\neZlIg/cwDQYJKoZIhvcNAQEFBQADggEBAF1PhPGoiNOjsrycbeUpSXfh59bcqdg1\nrslx3OXb3J0kIZCmz7cBHJvUV5eR13UWpRLXuT0uiT05aYrWNTf58SHEW0CtWakv\nXzoAKUMncQPkvTAyVab+hA4LmzgZLEN8rEO/dTHlIxxFVbdpCJG1z9fVsV7un5Tk\n1nq5GMO41lJjHBC6iy9tXcwFOPRWBW3vnuzoYTYMFEuFFFoMg08iXFnLjIpx2vrF\nEIRYzwfu45DC9fkpx1ojcflZtGQriLCnNseaIGHr+k61rmsb5OPs4tk8QUmoIKRU\n9ZKNu8BVIASm2LAXFszj0Mi0PeXZhMbT9m5teMl5Q+h6N/9cNUm/ocU=\n-----END CERTIFICATE-----",
      "-----BEGIN CERTIFICATE-----\nMIIEQjCCA6ugAwIBAgIEQodApTANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC\nVVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u\nZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc\nKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u\nZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEw\nMDEwNTAwMDBaFw0xNDA3MjYxODE1MTVaMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQK\nEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNV\nBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGzOVz5vvUu+UtLTKm3+WBP8nNJUm2cSrD\n1ZQ0Z6IKHLBfaaZAscS3so/QmKSpQVk609yU1jzbdDikSsxNJYL3SqVTEjju80lt\ncZF+Y7arpl/DpIT4T2JRvvjF7Ns4kuMG5QiRDMQoQVX7y1qJFX5x6DW/TXIJPb46\nOFBbdzEbjbPHJEWap6xtABRaBLe6E+tRCphBQSJOZWGHgUFQpnlcid4ZSlfVLuZd\nHFMsfpjNGgYWpGhz0DQEE1yhcdNafFXbXmThN4cwVgTlEbQpgBLxeTmIogIRfCdm\nt4i3ePLKCqg4qwpkwr9mXZWEwaElHoddGlALIBLMQbtuC1E4uEvLAgMBAAGjggET\nMIIBDzASBgNVHRMBAf8ECDAGAQH/AgEBMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggr\nBgEFBQcDAgYIKwYBBQUHAwQwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdo\ndHRwOi8vb2NzcC5lbnRydXN0Lm5ldDAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8v\nY3JsLmVudHJ1c3QubmV0L3NlcnZlcjEuY3JsMB0GA1UdDgQWBBSxPsNpA/i/RwHU\nmCYaCALvY2QrwzALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8BdiE1U9s/8KAGv7\nUISX8+1i0BowGQYJKoZIhvZ9B0EABAwwChsEVjcuMQMCAIEwDQYJKoZIhvcNAQEF\nBQADgYEASA4rbyBiTCiToyQ9WKshz4D4mpeQaiLtWnxHNpnneYR1qySPkgrVYQSu\nw2pcsszZ5ESHb9uPOGL3RDadurxuB8TUjegf0Qtgo7WczmO+7Wfc+Lrebskly1u1\nnXZwC99CcvhPQRFkpdLq/NWvEfQVOGecIKhLd1qRMkIy54Wz3zY=\n-----END CERTIFICATE-----"
    ],
    "from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "fw": 4450,
    "msm_id": 15002,
    "name": "atlas.ripe.net",
    "port": "https",
    "prb_id": 9,
    "srcaddr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
    "timestamp": 1338811367
  }

4. Version 4460

Version 4460 is identified by a value between "4460" and "4539" for the key fw in the result.

Changes between 4400 and 4460

The key "addr" in 4400 became "dst_addr" in 4460.
The key "address" in 4400 became "dst_addr" in 4460.
The key "mode" in 4400 became "af" and "proto" or "method" in 4460.
The key "name" in 4400 became "dst_name" in 4460.
The key "paris-id" in 4400 became "paris_id" in 4460.
The key "pf" in 4400 became "af" in 4460.
The key "port" in 4400 became "dst_port" in 4460.
The key "srcaddr" in 4400 became "src_addr" in 4460.
The following fields were added: "method" (where applicable), "ver" (where not already present but applicable), and "type".

RIPE Atlas - Raw data structure documentation

Table of contents

1. Notes

1.1. Versioning

1.2. Multiple Addresses in a Result

2. Version 1

2.1. Ping / v6 Ping

2.2. Traceroute / v6 Traceroute

3. Version 4400

3.1. Ping / v6 Ping

3.2. Traceroute / v6 Traceroute

3.3. DNS Lookup

3.4. HTTP

3.5. SSL GET Cert

4. Version 4460

4.1. Ping / v6 Ping

4.2. Traceroute / v6 Traceroute

4.3. DNS Lookup

4.4. HTTP

4.5. SSL GET Cert

5. Version 4540

5.1. Ping / v6 Ping

5.2. Traceroute / v6 Traceroute

5.3. DNS Lookup

5.4. HTTP

5.5. SSL GET Cert

6. Version 4570

6.1. Ping / v6 Ping

6.2. Traceroute / v6 Traceroute

6.3. DNS Lookup

6.5. SSL GET Cert

7. Version 4610

7.1. Ping / v6 Ping

7.2. Traceroute / v6 Traceroute

7.3. DNS Lookup

7.4. HTTP

7.5. NTP

7.6. SSL GET Cert