diff --git a/.gitignore b/.gitignore
index ea8c4bf..df611ec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /target
+__pycache__/
diff --git a/docs/lab/prod/pr01/bird.conf b/docs/lab/prod/pr01/bird.conf
index fecfcad..2f94133 100644
--- a/docs/lab/prod/pr01/bird.conf
+++ b/docs/lab/prod/pr01/bird.conf
@@ -8,14 +8,53 @@ filter rayhaan_net_only {
     reject;
 }
 
-function lab_export_allowed(int peer_as)
+#
+# Export control for lab routes (the /48s learned from ferrix).
+#
+# Every eBGP session states who it talks to and where: its neighbour AS and
+# one of the locations below. Students steer their prefix with large
+# communities, in this order of precedence:
+#
+#   1. 210036:0:<as>        never announce to that neighbour AS
+#      210036:2:<location>  never announce at that location
+#   2. 210036:1:<as>        announce to that neighbour AS
+#      210036:3:<location>  announce at that location
+#   3. 210036:0:0           announce nowhere (unless rule 2 says otherwise)
+#   4. nothing              announce everywhere                  <- default
+#
+# A "never" always wins, so the two dimensions combine: "to Cloudflare, but
+# not at DE-CIX" is 210036:0:0 210036:1:13335 210036:2:4.
+#
+define AT_SWISSIX      =   1;   # SwissIX
+define AT_NLIX         =   2;   # NL-ix
+define AT_FRANCEIX     =   3;   # France-IX
+define AT_DECIX        =   4;   # DE-CIX Frankfurt
+define AT_FREEIX       =   5;   # Free-IX Switzerland
+define AT_COMMUNITYIX  =   6;   # Community-IX.ch
+define AT_TRANSIT      = 100;   # transit (CommunityRack)
+define AT_DOWNSTREAM   = 200;   # downstream customers
+
+function lab_export_allowed(int peer_as; int location)
 {
     if (210036, 0, peer_as) ~ bgp_large_community then return false;
+    if (210036, 2, location) ~ bgp_large_community then return false;
     if (210036, 1, peer_as) ~ bgp_large_community then return true;
+    if (210036, 3, location) ~ bgp_large_community then return true;
     if (210036, 0, 0) ~ bgp_large_community then return false;
     return true;
 }
 
+# Decides whether a lab route goes out on a session and, if so, makes it
+# presentable: the origin must appear as AS210036 (matching the route6
+# objects) and our action communities must not leak.
+function lab_route_out(int peer_as; int location)
+{
+    if !lab_export_allowed(peer_as, location) then return false;
+    bgp_path.delete([ 64512..65534, 4200000000..4294967294 ]);
+    bgp_large_community.delete([ (210036, 0..3, *) ]);
+    return true;
+}
+
 protocol kernel kernel4 {
     kernel table 200;
     scan time 120;
@@ -47,41 +86,33 @@ protocol direct {
     };
 }
 
-filter peers_out {
+function peers_out(int peer_as; int location)
+{
     bgp_med = 0;
     bgp_large_community.add((210036, 10, 2));
-    if (net = 193.36.104.0/24) then accept;
-    if (net = 2a0d:d740::/48) then accept;
-    if (net = 2a0d:d740:105::/48) then accept;
-    if proto = "delroth_v6" then accept;
-    if proto = "pkern_v6" then accept;
-    if proto = "home_v4" then accept;
-    if proto = "ferrix" then {
-        if !lab_export_allowed(42476) then reject;
-        bgp_path.delete([ 64512..65534, 4200000000..4294967294 ]);
-        bgp_large_community.delete([ (210036, 0..1, *) ]);
-        accept;
-    }
-    reject;
+    if (net = 193.36.104.0/24) then return true;
+    if (net = 2a0d:d740::/48) then return true;
+    if (net = 2a0d:d740:105::/48) then return true;
+    if proto = "delroth_v6" then return true;
+    if proto = "pkern_v6" then return true;
+    if proto = "home_v4" then return true;
+    if proto = "ferrix" then return lab_route_out(peer_as, location);
+    return false;
 }
 
-filter comrack_out {
+function comrack_out(int peer_as; int location)
+{
     bgp_med = 500;
     bgp_large_community.add((210036, 10, 2));
-    if (net = 193.36.104.0/24) then accept;
-    if (net = 2a0d:d740::/48) then accept;
-    if proto = "benfiedler_v4" then accept;
-    if proto = "benfiedler_v6" then accept;
-    if proto = "delroth_v6" then accept;
-    if proto = "pkern_v6" then accept;
-    if proto = "home_v4" then accept;
-    if proto = "ferrix" then {
-        if !lab_export_allowed(42476) then reject;
-        bgp_path.delete([ 64512..65534, 4200000000..4294967294 ]);
-        bgp_large_community.delete([ (210036, 0..1, *) ]);
-        accept;
-    }
-    reject;
+    if (net = 193.36.104.0/24) then return true;
+    if (net = 2a0d:d740::/48) then return true;
+    if proto = "benfiedler_v4" then return true;
+    if proto = "benfiedler_v6" then return true;
+    if proto = "delroth_v6" then return true;
+    if proto = "pkern_v6" then return true;
+    if proto = "home_v4" then return true;
+    if proto = "ferrix" then return lab_route_out(peer_as, location);
+    return false;
 }
 
 filter peers_in {
@@ -111,7 +142,7 @@ protocol bgp comrack_v4 {
     local 185.95.219.37 as 210036;
     neighbor 185.95.219.36 as 57118;
     ipv4 {
-        export filter comrack_out;
+        export where comrack_out(57118, AT_TRANSIT);
         import filter {
             if (net = 0.0.0.0/0) then {
                 reject;
@@ -137,7 +168,7 @@ protocol bgp comrack_v6 {
     local 2a05:fc87:1:12::b as 210036;
     neighbor 2a05:fc87:1:12::a as 57118;
     ipv6 {
-        export filter comrack_out;
+        export where comrack_out(57118, AT_TRANSIT);
         import filter {
             if (net = ::/0) then {
                 reject;
@@ -186,7 +217,7 @@ protocol bgp swissix_rs1_v4 {
     neighbor 91.206.52.252 as 42476;
     default bgp_local_pref 500;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(42476, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -197,7 +228,7 @@ protocol bgp swissix_rs1_v6 {
     neighbor 2001:7f8:24::a5ec:a:1 as 42476;
     default bgp_local_pref 500;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(42476, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -210,7 +241,7 @@ protocol bgp swissix_rs2_v4 {
     neighbor 91.206.53.253 as 42476;
     default bgp_local_pref 500;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(42476, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -221,7 +252,7 @@ protocol bgp swissix_rs2_v6 {
     neighbor 2001:7f8:24::a5ec:a:2 as 42476;
     default bgp_local_pref 500;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(42476, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -233,7 +264,7 @@ protocol bgp swissix_he_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.52.170 as 6939;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(6939, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -243,7 +274,7 @@ protocol bgp swissix_he_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::aa as 6939;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(6939, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -255,7 +286,7 @@ protocol bgp swissix_pim_8298_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.53.12 as 8298;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(8298, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -265,7 +296,7 @@ protocol bgp swissix_pim_8298_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::10c as 8298;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(8298, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -276,7 +307,7 @@ protocol bgp swissix_andrew_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.52.243 as 34615;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(34615, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -285,7 +316,7 @@ protocol bgp swissix_andrew_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::f3 as 34615;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(34615, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -296,7 +327,7 @@ protocol bgp swissix_tobias_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.53.19 as 212495;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(212495, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -305,7 +336,7 @@ protocol bgp swissix_tobias_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::113 as 212495;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(212495, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -316,7 +347,7 @@ protocol bgp swissix_meerfabrig_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.52.244 as 34549;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(34549, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -325,7 +356,7 @@ protocol bgp swissix_meerfabrig_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::f4 as 34549;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(34549, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -336,7 +367,7 @@ protocol bgp swissix_akamai_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.52.56 as 20940;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(20940, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -345,7 +376,7 @@ protocol bgp swissix_akamai_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::38 as 20940;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(20940, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -356,7 +387,7 @@ protocol bgp swissix_jmp_technologies_v4 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.53.18 as 61423;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(61423, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -365,7 +396,7 @@ protocol bgp swissix_jmp_technologies_v6 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::112 as 61423;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(61423, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -375,7 +406,7 @@ protocol bgp swissix_google_v4_1 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.52.74 as 15169;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(15169, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -384,7 +415,7 @@ protocol bgp swissix_google_v6_1 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::4a as 15169;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(15169, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -394,7 +425,7 @@ protocol bgp swissix_google_v4_2 {
     local 91.206.52.201 as 210036;
     neighbor 91.206.52.223 as 15169;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(15169, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -404,7 +435,7 @@ protocol bgp swissix_google_v6_2 {
     local 2001:7f8:24::c9 as 210036;
     neighbor 2001:7f8:24::df as 15169;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(15169, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -417,7 +448,7 @@ protocol bgp swissix_31173_v4 {
     # Higher local pref for Zurich.
     default bgp_local_pref 200;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(39351, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -429,7 +460,7 @@ protocol bgp swissix_31173_v6 {
     # Higher local pref for Zurich.
     default bgp_local_pref 200;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(39351, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -442,7 +473,7 @@ protocol bgp swissix_cloudflare_v4 {
     # Higher local pref for Zurich.
     default bgp_local_pref 200;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -454,7 +485,7 @@ protocol bgp swissix_cloudflare_v6 {
     # Higher local pref for Zurich.
     default bgp_local_pref 200;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -467,7 +498,7 @@ protocol bgp swissix_i3d_v4 {
     # Higher local pref for Zurich.
     default bgp_local_pref 200;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(49544, AT_SWISSIX);
         import filter peers_in;
         export limit 10;
     };
@@ -479,7 +510,7 @@ protocol bgp swissix_i3d_v6 {
     # Higher local pref for Zurich.
     default bgp_local_pref 200;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(49544, AT_SWISSIX);
         import filter peers_in;
         export limit 200;
     };
@@ -496,7 +527,7 @@ protocol bgp nl_ix_rs1_v4 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.116.255 as 34307;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(34307, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -505,7 +536,7 @@ protocol bgp nl_ix_rs1_v6 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a503:4307:1 as 34307;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(34307, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -516,7 +547,7 @@ protocol bgp nl_ix_rs2_v4 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.117.0 as 34307;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(34307, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -525,7 +556,7 @@ protocol bgp nl_ix_rs2_v6 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a503:4307:2 as 34307;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(34307, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -536,7 +567,7 @@ protocol bgp nl_ix_apple_v4_r1 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.117.112 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -545,7 +576,7 @@ protocol bgp nl_ix_apple_v6_r1 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a500:714:1 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -555,7 +586,7 @@ protocol bgp nl_ix_apple_v4_r2 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.117.113 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -564,7 +595,7 @@ protocol bgp nl_ix_apple_v6_r2 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a500:714:2 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -576,7 +607,7 @@ protocol bgp nl_ix_he_v4 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.116.14 as 6939;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(6939, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -585,7 +616,7 @@ protocol bgp nl_ix_he_v6 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a500:6939:1 as 6939;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(6939, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -596,12 +627,12 @@ protocol bgp nl_ix_cloudflare_1 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a501:3335:1 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -610,12 +641,12 @@ protocol bgp nl_ix_cloudflare_2 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a501:3335:2 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -624,12 +655,12 @@ protocol bgp nl_ix_cloudflare_3 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a501:3335:3 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -638,7 +669,7 @@ protocol bgp nl_ix_cloudflare_4 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a501:3335:4 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -647,7 +678,7 @@ protocol bgp nl_ix_cloudflare_v4_1 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.117.114 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -656,7 +687,7 @@ protocol bgp nl_ix_cloudflare_v4_2 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.118.138 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -665,7 +696,7 @@ protocol bgp nl_ix_cloudflare_v4_3 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.119.101 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -674,7 +705,7 @@ protocol bgp nl_ix_cloudflare_v4_4 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.117.14 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -685,7 +716,7 @@ protocol bgp nl_ix_31173_v4 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.116.34 as 39351;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(39351, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -695,7 +726,7 @@ protocol bgp nl_ix_31173_v6 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a503:9351:1 as 39351;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(39351, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -705,7 +736,7 @@ protocol bgp nl_ix_i3d_v4 {
     local 193.239.117.206 as 210036;
     neighbor 193.239.117.76 as 49544;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(49544, AT_NLIX);
         import filter peers_in;
         export limit 10;
     };
@@ -715,7 +746,7 @@ protocol bgp nl_ix_i3d_v6 {
     local 2001:7f8:13::a521:36:1 as 210036;
     neighbor 2001:7f8:13::a504:9544:1 as 49544;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(49544, AT_NLIX);
         import filter peers_in;
         export limit 200;
     };
@@ -729,7 +760,7 @@ protocol bgp france_ix_rs1_v4{
     local 37.49.238.32 as 210036;
     neighbor 37.49.236.250 as 51706;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(51706, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -738,7 +769,7 @@ protocol bgp france_ix_rs1_v6 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::250 as 51706;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(51706, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -749,7 +780,7 @@ protocol bgp france_ix_he_v4{
     local 37.49.238.32 as 210036;
     neighbor 37.49.236.10 as 6939;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(6939, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -758,7 +789,7 @@ protocol bgp france_ix_he_v6 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::10 as 6939;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(6939, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -769,7 +800,7 @@ protocol bgp france_ix_transatel_v4{
     local 37.49.238.32 as 210036;
     neighbor 37.49.236.140 as 198335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(198335, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -778,7 +809,7 @@ protocol bgp france_ix_transatel_v6 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::140 as 198335;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(198335, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -789,7 +820,7 @@ protocol bgp france_ix_apple_v4_r1 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.176 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -798,7 +829,7 @@ protocol bgp france_ix_apple_v6_r1 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::1:176 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -808,7 +839,7 @@ protocol bgp france_ix_apple_v4_r2 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.179 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -817,7 +848,7 @@ protocol bgp france_ix_apple_v6_r2 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::1:179 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -827,7 +858,7 @@ protocol bgp france_ix_akamai_v4_r1 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.236.168 as 20940;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(20940, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -836,7 +867,7 @@ protocol bgp france_ix_akamai_v6_r1 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::168 as 20940;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(20940, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -846,7 +877,7 @@ protocol bgp france_ix_akamai_v4_r2 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.164 as 32787;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(32787, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -855,7 +886,7 @@ protocol bgp france_ix_akamai_v6_r2 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::1:164 as 32787;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(32787, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -865,7 +896,7 @@ protocol bgp france_ix_cloudflare_v4_r1 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.49 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -874,7 +905,7 @@ protocol bgp france_ix_cloudflare_v4_r2 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.238.59 as 13335;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -883,7 +914,7 @@ protocol bgp france_ix_cloudflare_v6_r1 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::1:49 as 13335;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -892,7 +923,7 @@ protocol bgp france_ix_cloudflare_v6_r2 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::2:59 as 13335;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -902,12 +933,12 @@ protocol bgp france_ix_alibaba {
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.201 as 45102;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(45102, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
     ipv6 {
-        export filter peers_out;
+        export where peers_out(45102, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -917,7 +948,7 @@ protocol bgp france_ix_i3d_v4 {
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.230 as 49544;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(49544, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -927,7 +958,7 @@ protocol bgp france_ix_i3d_v6_r1 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::1:230 as 49544;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(49544, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -938,7 +969,7 @@ protocol bgp france_ix_39351_v4{
     local 37.49.238.32 as 210036;
     neighbor 37.49.237.171 as 39351;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(39351, AT_FRANCEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -947,7 +978,7 @@ protocol bgp france_ix_39351_v6 {
     local 2001:7f8:54::2:32 as 210036;
     neighbor 2001:7f8:54::1:171 as 39351;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(39351, AT_FRANCEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -962,7 +993,7 @@ protocol bgp de_cix_rs1_v4 {
     neighbor 80.81.192.157 as 6695;
     default bgp_local_pref 150;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(6695, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -972,7 +1003,7 @@ protocol bgp de_cix_rs1_v6 {
     neighbor 2001:7f8::1a27:5051:c09d as 6695;
     default bgp_local_pref 150;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(6695, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -983,7 +1014,7 @@ protocol bgp de_cix_rs2_v4 {
     neighbor 80.81.193.157 as 6695;
     default bgp_local_pref 150;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(6695, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -993,7 +1024,7 @@ protocol bgp de_cix_rs2_v6 {
     neighbor 2001:7f8::1a27:5051:c19d as 6695;
     default bgp_local_pref 150;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(6695, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1004,7 +1035,7 @@ protocol bgp de_cix_apple_v4_r1 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.193.202 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1013,7 +1044,7 @@ protocol bgp de_cix_apple_v6_r1 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::2ca:0:1 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1023,7 +1054,7 @@ protocol bgp de_cix_apple_v4_r2 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.193.223 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1032,7 +1063,7 @@ protocol bgp de_cix_apple_v6_r2 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::2ca:0:2 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1042,7 +1073,7 @@ protocol bgp de_cix_apple_v4_r3 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.194.171 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1051,7 +1082,7 @@ protocol bgp de_cix_apple_v6_r3 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::2ca:0:4 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1061,7 +1092,7 @@ protocol bgp de_cix_apple_v4_r4 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.194.161 as 714;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1070,7 +1101,7 @@ protocol bgp de_cix_apple_v6_r4 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::2ca:0:3 as 714;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(714, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1081,7 +1112,7 @@ protocol bgp de_cix_cprm_v4 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.192.38 as 8657;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(8657, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1090,7 +1121,7 @@ protocol bgp de_cix_cprm_v6 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::21d1:0:1 as 8657;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(8657, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1101,7 +1132,7 @@ protocol bgp de_cix_clouflare_v4_1 {
     neighbor 80.81.194.180 as 13335;
     default bgp_local_pref 150;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1111,7 +1142,7 @@ protocol bgp de_cix_clouflare_v4_2 {
     neighbor 80.81.193.129 as 13335;
     default bgp_local_pref 150;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(13335, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1122,7 +1153,7 @@ protocol bgp de_cix_cloudflare_v6_1 {
     neighbor 2001:7f8::3417:0:1 as 13335;
     default bgp_local_pref 150;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1133,7 +1164,7 @@ protocol bgp de_cix_cloudflare_v6_2 {
     neighbor 2001:7f8::3417:0:2 as 13335;
     default bgp_local_pref 150;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(13335, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1143,12 +1174,12 @@ protocol bgp de_cix_alibaba {
     local 80.81.196.144 as 210036;
     neighbor 80.81.195.60 as 45102;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(45102, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
     ipv6 {
-        export filter peers_out;
+        export where peers_out(45102, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1158,7 +1189,7 @@ protocol bgp de_cix_jmp_technologies_v4 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.195.13 as 61423;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(61423, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1168,7 +1199,7 @@ protocol bgp de_cix_jmp_technologies_v6 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::efef:0:1 as 61423;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(61423, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1179,7 +1210,7 @@ protocol bgp de_cix_31173_v4 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.195.179 as 39351;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(39351, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1188,7 +1219,7 @@ protocol bgp de_cix_31173_v6 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::99b7:0:1 as 39351;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(39351, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1198,13 +1229,13 @@ protocol bgp de_cix_alibaba_multi {
     local 80.81.196.144 as 210036;
     neighbor 80.81.194.33 as 45102;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(45102, AT_DECIX);
         import filter peers_in;
         export limit 10;
 	import limit 100;
     };
     ipv6 {
-        export filter peers_out;
+        export where peers_out(45102, AT_DECIX);
         import filter peers_in;
         export limit 10;
 	import limit 100;
@@ -1215,7 +1246,7 @@ protocol bgp de_cix_i3d_v4 {
     local 80.81.196.144 as 210036;
     neighbor 80.81.194.107 as 49544;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(49544, AT_DECIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1224,7 +1255,7 @@ protocol bgp de_cix_i3d_v6 {
     local 2001:7f8::3:3474:0:1 as 210036;
     neighbor 2001:7f8::c188:0:1 as 49544;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(49544, AT_DECIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1238,7 +1269,7 @@ protocol bgp free_ix_rs1_v4 {
     local 185.1.205.5 as 210036;
     neighbor 185.1.205.254 as 51530;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(51530, AT_FREEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1247,7 +1278,7 @@ protocol bgp free_ix_rs1_v6 {
     local 2001:7f8:111:42:0:3:3474:1 as 210036;
     neighbor 2001:7f8:111:42::c94a:1 as 51530;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(51530, AT_FREEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1257,7 +1288,7 @@ protocol bgp free_ix_rs2_v4 {
     local 185.1.205.5 as 210036;
     neighbor 185.1.205.253 as 51530;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(51530, AT_FREEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1266,7 +1297,7 @@ protocol bgp free_ix_rs2_v6 {
     local 2001:7f8:111:42:0:3:3474:1 as 210036;
     neighbor 2001:7f8:111:42::c94a:2 as 51530;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(51530, AT_FREEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1276,7 +1307,7 @@ protocol bgp free_ix_otg_v4 {
     local 185.1.205.5 as 210036;
     neighbor 185.1.205.12 as 35202;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(35202, AT_FREEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1286,7 +1317,7 @@ protocol bgp free_ix_otg_v6 {
     local 2001:7f8:111:42:0:3:3474:1 as 210036;
     neighbor 2001:7f8:111:42::8982:1 as 35202;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(35202, AT_FREEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1296,7 +1327,7 @@ protocol bgp free_ix_remote_v4 {
     local 185.1.205.5 as 210036;
     neighbor 185.1.205.7 as 50869;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(50869, AT_FREEIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1306,7 +1337,7 @@ protocol bgp free_ix_remote_v6 {
     local 2001:7f8:111:42:0:3:3474:1 as 210036;
     neighbor 2001:7f8:111:42::c6b5:1 as 50869;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(50869, AT_FREEIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1320,7 +1351,7 @@ protocol bgp com_ix_otg_v4 {
     local 185.1.105.7 as 210036;
     neighbor 185.1.105.3 as 35202;
     ipv4 {
-        export filter peers_out;
+        export where peers_out(35202, AT_COMMUNITYIX);
         import filter peers_in;
         export limit 10;
     };
@@ -1330,7 +1361,7 @@ protocol bgp com_ix_otg_v6 {
     local 2001:7f8:bf:1::7 as 210036;
     neighbor 2001:7f8:bf:1::3 as 35202;
     ipv6 {
-        export filter peers_out;
+        export where peers_out(35202, AT_COMMUNITYIX);
         import filter peers_in;
         export limit 200;
     };
@@ -1344,6 +1375,10 @@ protocol bgp delroth_v6 {
     default bgp_local_pref 1000;
     ipv6 {
         export filter {
+            if proto = "ferrix" then {
+                if lab_route_out(210400, AT_DOWNSTREAM) then accept;
+                reject;
+            }
             accept; # Announce all routes to downstream.
         };
         import filter {
@@ -1375,6 +1410,10 @@ protocol bgp pkern_v6 {
     };
     ipv6 {
         export filter {
+            if proto = "ferrix" then {
+                if lab_route_out(210617, AT_DOWNSTREAM) then accept;
+                reject;
+            }
             accept; # Announce all routes to downstream.
         };
         import filter {
@@ -1431,7 +1470,7 @@ filter ferrix_import
     if bgp_path.len > 17 then reject;
     if bgp_path.first != FERRIX_ASN then reject;
     bgp_community.filter([ (65535, 65281), (65535, 65282) ]);
-    bgp_large_community.filter([ (42476, *, *), (210036, 0..1, *) ]);
+    bgp_large_community.filter([ (42476, *, *), (210036, 0..3, *) ]);
     bgp_ext_community.empty;
     dest = RTD_UNREACHABLE;
     accept;
@@ -1439,10 +1478,12 @@ filter ferrix_import
 
 protocol bgp ferrix
 {
-    description "ferrix_bgp teaching lab (announce only)";
-    local 2a0d:d747:1::1 as 210036;
-    neighbor 2a0d:d747:1:: as FERRIX_ASN;
-    direct;
+    description "ferrix_bgp teaching lab (announce only, same host)";
+    local ::1 as 210036;
+    neighbor ::1 as FERRIX_ASN;
+    # Both ends are this machine, so there is no directly connected
+    # neighbour for "direct" (the eBGP default) to find.
+    multihop;
     passive on;
     ipv6 {
         import filter ferrix_import;
diff --git a/docs/lab/ripe/lab-objects.rpsl b/docs/lab/ripe/lab-objects.rpsl
new file mode 100644
index 0000000..739e68c
--- /dev/null
+++ b/docs/lab/ripe/lab-objects.rpsl
@@ -0,0 +1,779 @@
+inet6num:       2a0d:d741::/40
+netname:        CH-RAY-ETHZ-NETSEC-LAB-2026
+descr:          ETHZ Netsec 2026 BGP hands-on lab, one /48 per student
+country:        CH
+org:            ORG-RAJ2-RIPE
+admin-c:        RJ4890-RIPE
+tech-c:         RJ4890-RIPE
+status:         AGGREGATED-BY-LIR
+assignment-size: 48
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 1
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 2
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 3
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 4
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 5
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 6
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 7
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:8::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 8
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:9::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 9
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 10
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 11
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 12
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 13
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 14
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 15
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:10::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 16
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:11::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 17
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:12::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 18
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:13::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 19
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:14::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 20
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:15::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 21
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:16::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 22
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:17::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 23
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:18::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 24
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:19::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 25
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 26
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 27
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 28
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 29
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 30
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:1f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 31
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:20::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 32
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:21::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 33
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:22::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 34
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:23::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 35
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:24::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 36
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:25::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 37
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:26::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 38
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:27::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 39
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:28::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 40
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:29::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 41
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 42
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 43
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 44
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 45
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 46
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:2f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 47
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:30::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 48
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:31::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 49
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:32::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 50
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:33::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 51
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:34::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 52
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:35::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 53
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:36::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 54
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:37::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 55
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:38::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 56
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:39::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 57
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 58
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 59
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 60
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 61
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 62
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:3f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 63
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:40::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 64
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:41::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 65
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:42::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 66
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:43::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 67
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:44::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 68
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:45::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 69
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:46::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 70
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:47::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 71
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:48::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 72
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:49::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 73
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 74
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 75
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 76
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 77
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 78
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:4f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 79
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:50::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 80
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:51::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 81
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:52::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 82
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:53::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 83
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:54::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 84
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:55::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 85
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:56::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 86
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:57::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 87
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:58::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 88
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:59::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 89
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 90
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 91
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 92
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 93
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 94
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:5f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 95
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:60::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 96
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:61::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 97
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:62::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 98
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:63::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 99
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:64::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 100
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:65::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 101
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:66::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 102
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:67::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 103
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:68::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 104
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:69::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 105
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 106
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 107
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 108
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 109
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 110
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:6f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 111
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:70::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 112
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:71::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 113
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:72::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 114
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:73::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 115
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:74::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 116
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:75::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 117
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:76::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 118
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:77::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 119
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:78::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 120
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:79::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 121
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7a::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 122
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7b::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 123
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7c::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 124
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7d::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 125
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7e::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 126
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:7f::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 127
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE
+
+route6:         2a0d:d741:80::/48
+descr:          ETHZ Netsec 2026 BGP lab - student 128
+origin:         AS210036
+mnt-by:         mnt-ch-ray-1
+source:         RIPE