BGP and Internet Routing
BGP is how the internet holds itself together: about 80,000 autonomous systems trading reachability information, mostly on trust. It is also the protocol behind the outages you read about in the news.
The model
An Autonomous System (AS) is a network under one administrative policy, identified by an ASN. BGP exchanges prefixes with attributes, and each AS applies policy about what it will accept and what it will advertise.
| Property | Value |
|---|---|
| Transport | TCP 179 |
| Type | Path-vector, exterior gateway protocol |
| Peering | eBGP (different AS), iBGP (same AS) |
| Convergence | Slow by design — policy, not speed |
| Typical internet table | Just under a million IPv4 prefixes |
A path-vector carries the AS path so loops can be detected: if a router sees its own ASN in the path, it rejects the route.
What BGP actually decides
BGP does not choose the shortest path by distance. It applies a policy ladder, roughly:
- Highest weight (Cisco-local, not advertised)
- Highest local preference (how much this AS likes this exit)
- Locally originated (network/redistribute) beats learned
- Shortest AS path
- Lowest origin type (IGP < EGP < incomplete)
- Lowest MED (a hint to the neighbouring AS)
- Prefer eBGP over iBGP
- Lowest IGP metric to the next hop
- Lowest router ID
Most real traffic engineering happens at steps 2 and 6.
eBGP vs iBGP, and why iBGP needs a full mesh or reflectors
- eBGP: neighbours in different ASes, TTL 1 by default, next hop rewritten.
- iBGP: neighbours in the same AS, no next-hop rewrite, and routes learned from one iBGP peer are not re-advertised to another — hence full mesh, route reflectors, or confederations.
That split-horizon rule is the single most confusing thing about iBGP, and the reason a new router "has no routes" while its session is up.
The failure modes that make the news
| Failure | What happens | Recent-scale example class |
|---|---|---|
| Prefix hijack | An AS advertises someone else's prefix; the internet believes the more specific route | National outages, crypto theft |
| Route leak | A customer re-advertises a provider's routes, pulling traffic through a small network | Global slowdowns from a single misconfiguration |
| BGP session drop | Peer resets, routes withdrawn, traffic falls to a backup or a blackhole | Regional outages |
| Max-prefix exceeded | Peer sends more prefixes than configured; session is torn down by design | "It worked until it scaled" |
| RPKI not deployed | Nobody cryptographically verifies who may originate a prefix | Hijacks propagate |
RPKI (Resource Public Key Infrastructure) signs route origin authorisations, and ROV (route origin validation) lets a network drop invalid announcements. Deployment is partial, which is why hijacks still work.
What a practitioner needs to be able to do
show ip bgp summary # session state, prefixes received
show ip bgp 203.0.113.0/24 # attributes and best path
show ip bgp neighbors 198.51.100.1 advertised-routes
show ip route bgp
# Looking glasses and public data
whois -h whois.radb.net 203.0.113.10
curl -s https://stat.ripe.net/data/prefix-overview/data.json?resource=203.0.113.0/24
- Explain why traffic leaves via one ISP and returns via another.
- Read an AS path and tell where a route was learned.
- Know that "the internet is down" usually means "our announcement changed".
Where it goes wrong
- Advertising a prefix you do not own. A typo in a route-map takes down someone else's service, and sometimes your own.
- No max-prefix limit. A misbehaving peer sends a full table and exhausts memory on the router.
- Filtering only one direction. You filter what you send, not what you accept, and inherit a hijack.
- Assuming BGP converges fast. It is designed for policy stability; failover can take tens of seconds, which is why fast-external-failover and BFD exist.
- Asymmetric return paths. Outbound via ISP A, inbound via ISP B. Works, until the stateful firewall in the middle sees half a conversation.
- Changing local preference to "fix" performance without measuring. Traffic moves; latency does not improve; the change stays forever.
- Forgetting IPv6. A dual-stack network with no IPv6 BGP policy has a very large implicit "permit any" on v6.
Related Notes
- Routing Fundamentals — where BGP sits among protocols
- OSPF Fundamentals — the IGP that resolves BGP next hops
- Route Selection And Metrics — combining policy ladders
- DDoS And Availability Attacks — BGP's role in mitigation