BGP (Border Gateway Protocol)

BGP is the routing protocol that holds the internet together. It allows autonomous systems (independent networks) to exchange reachability information, determining how IP traffic is routed between every network on the planet.

How BGP Works

The internet is composed of tens of thousands of autonomous systems (ASes), each identified by a unique Autonomous System Number (ASN). Each AS controls a set of IP prefixes and uses BGP to announce those prefixes to its neighbors. When an AS receives an announcement, it evaluates the route using local policy and path attributes, decides whether to accept it, and may propagate it further to its own neighbors.

BGP routers maintain a table of all reachable prefixes, the AS path to reach each one, and associated attributes. When multiple paths exist for the same prefix, the router selects the best one based on a decision process that considers local preference, AS path length, origin type, multi-exit discriminator (MED), and other attributes.

BGP sessions run over TCP (port 179). Routers exchange UPDATE messages to advertise new routes or withdraw previously announced ones. The protocol is incremental: after the initial full table exchange, only changes are sent.

Key Concepts

• ASN (Autonomous System Number) - a unique identifier assigned to each independently operated network. For example, Cloudflare is AS13335 and Google is AS15169. ASNs can be 16-bit (0-65535) or 32-bit.
• Prefix announcement - an AS advertises that it is responsible for a block of IP addresses (e.g., 1.1.1.0/24). Neighboring ASes propagate this announcement across the internet.
• AS path - the sequence of ASNs that a route announcement has traversed. Shorter paths are generally preferred. The AS path also serves as a loop-prevention mechanism.
• Peering vs. transit - peering is a mutual agreement between two ASes to exchange traffic directly. Transit is a paid relationship where one AS provides access to the rest of the internet.
• eBGP vs. iBGP - external BGP (eBGP) runs between different autonomous systems. Internal BGP (iBGP) runs between routers within the same AS to distribute externally learned routes.

BGP Hijacking

BGP was designed in an era of implicit trust between network operators. There is no built-in mechanism to verify that an AS is authorized to announce a given prefix. A BGP hijack occurs when an AS announces a prefix it does not own, either by accident (misconfiguration) or deliberately (attack).

Because BGP routers prefer more specific prefixes, an attacker can hijack traffic by announcing a longer prefix than the legitimate one. For example, if the real owner announces 1.0.0.0/16, an attacker announcing 1.0.0.0/24 will attract traffic for that /24 block from much of the internet.

Hijacks can redirect traffic for interception, blackhole it to cause outages, or reroute it to impersonate services. Notable incidents have affected major cloud providers, CDNs, and even cryptocurrency exchanges.

RPKI and Route Origin Validation

Resource Public Key Infrastructure (RPKI) is the primary defense against BGP hijacking. It works by creating cryptographically signed objects called Route Origin Authorizations (ROAs) that bind an IP prefix to the ASN authorized to announce it.

The process works as follows:

1. The IP address holder creates a ROA in their Regional Internet Registry (RIR), specifying which ASN is authorized to originate each prefix and the maximum prefix length allowed.
2. Validating networks download ROAs and build a local validated cache.
3. When a BGP route is received, the router checks the origin ASN and prefix against the ROA database. Routes can be marked as Valid, Invalid, or NotFound.
4. Invalid routes (where the origin ASN does not match the ROA) can be rejected automatically, preventing hijacks.

RPKI adoption has grown significantly. Major networks including Cloudflare, Google, AT&T, and NTT now perform Route Origin Validation and drop RPKI-invalid routes. However, coverage is not yet universal, and many prefixes still lack ROAs.

Why Engineers Should Care

BGP routing directly affects the latency, availability, and security of your services:

• Latency - suboptimal routing can send traffic through distant regions. Understanding BGP helps you work with your provider to optimize paths.
• Availability - route leaks and hijacks cause outages that are outside your control but directly impact your users. Monitoring BGP visibility for your prefixes gives you early warning.
• Security - if your traffic is rerouted through an adversary's network, TLS protects the content but metadata (who is connecting where) is exposed. BGP hijacking has been used to obtain fraudulent TLS certificates by redirecting domain validation traffic.
• Incident response - when a service is unreachable from certain networks but fine from others, the cause is often a BGP issue. Knowing how to read AS paths and check route propagation is essential for diagnosing these problems.

Check route and RPKI status with the BGP tool →