PlayInfoBox

Home /Network /What Is BGP? Internet Routing Fundamentals Explained

What Is BGP? Internet Routing Fundamentals Explained

Ever wonder how thousands of independently run networks manage to tell each other how to reach the rest of the internet? This guide explains the protocol behind that conversation, how it picks routes, and why it fails the way it does.

What BGP is

BGP (Border Gateway Protocol) is designed for exchanging route information between networks operated by entirely separate organizations, unlike the routing used inside a home or office network. The internet isn't really one giant network -- it's a 'network of networks,' made up of countless individually operated networks run by ISPs, cloud providers, universities, and companies, all connected through BGP. The version in use today is BGP-4, specified in RFC 4271, and it has been the internet's inter-domain routing protocol since the 1990s.

What an autonomous system (AS) is

ISPs, major cloud providers, universities, and large companies each operate one or more autonomous systems, and are assigned a globally unique AS number (ASN) by an international internet registry. There are five regional registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC), and tens of thousands of ASNs are in use. Strictly speaking, BGP doesn't exchange routes between individual IP addresses -- it exchanges routes between autonomous systems. Some ASN ranges are reserved for private use, similar to private IP address ranges.

Route advertisement and best-path selection

When an AS advertises the IP ranges it's responsible for, neighboring ASes record that in their routing tables and pass the advertisement along to their own neighbors. As this repeats, routers across the world learn which sequence of ASes (the AS path) leads to a given destination, and when multiple candidate paths exist, they pick one using criteria such as which path passes through fewer ASes. In practice the decision runs through an ordered list: operators first apply their own local preference (cost, contracts, capacity), and only afterward do shorter AS paths and other tie-breakers come into play.

Why the most specific prefix wins

Before comparing paths, routers apply a more basic rule: the longest matching prefix wins. If one AS announces 203.0.113.0/24 and another announces only the larger block 203.0.0.0/16 that contains it, traffic for an address inside the /24 follows the /24 route, regardless of AS path length. This rule is useful for traffic engineering, but it is also exactly why hijackers like to announce a more specific prefix than the victim's. As a common practical limit, many networks filter out IPv4 announcements more specific than /24 and IPv6 announcements more specific than /48.

Peering vs transit relationships

Large carriers and content providers often connect directly at internet exchange points (IXPs) and exchange each other's traffic for free -- a relationship called peering. Smaller networks without their own long-haul infrastructure instead pay a larger carrier for a 'transit' contract that provides a route to the entire rest of the internet. A customer expects its provider to announce its routes to everyone, but a peer only carries traffic for the peer's own customers. Money, not geography alone, therefore shapes many of the paths traffic takes.

What BGP hijacking is

BGP hijacking happens when a network advertises an IP range it doesn't actually control -- by mistake or on purpose -- pulling traffic meant for another network toward the wrong destination. Because BGP is built to trust the routes its neighbors advertise, a single misconfiguration or malicious advertisement can misdirect traffic meant for that range. A well-known example occurred in February 2008, when a Pakistani ISP trying to block YouTube locally announced a more specific route that leaked to the wider internet and pulled YouTube traffic away from the real service for a period of time.

Why BGP was designed around trust

BGP was created in the late 1980s, when relatively few organizations were connected to the internet and a baseline of mutual trust was reasonable. As a result, its original design has no built-in cryptographic way to verify that an advertisement genuinely comes from the legitimate owner of that IP range -- a structural weakness that persists to this day. Security has had to be added from the outside, through filtering by providers, registries of intended routes, and cryptographic certificates.

How RPKI verifies routes

RPKI (Resource Public Key Infrastructure) lets address registries cryptographically certify, in advance, which AS is authorized to advertise which IP range, using signed objects called ROAs (Route Origin Authorizations). Networks that adopt RPKI can check incoming BGP advertisements against these certificates, a process called route origin validation, and automatically filter out advertisements from unauthorized sources. RPKI checks who is allowed to originate a prefix; it does not by itself prove that the whole path is honest. Not every network has adopted it yet, so raising adoption remains an ongoing challenge for the internet security community, and industry efforts such as MANRS encourage operators to follow basic routing hygiene.

Why one small mistake can cause a worldwide outage

If a single AS mistakenly advertises far more IP space than it actually owns, or leaks bad route information, neighboring ASes accept and repropagate it, letting the error spread across the internet within minutes. That's why 'a BGP routing issue caused by a configuration error' shows up so often as the root cause behind major outages at large internet services and cloud providers. A different failure mode is withdrawal: in October 2021, a configuration change at Facebook caused its networks to stop advertising their routes, and its services were unreachable for several hours.

A worked example of how a route spreads

Imagine a small company, AS 64500 (a number from the private range, used here only as an illustration), that owns the block 198.51.100.0/24 and buys transit from a regional carrier. The company's router announces the block to the carrier. The carrier adds its own AS number to the path and announces the block to its own transit provider and to its peers, who add their numbers in turn. After a few hops, a router on the other side of the world holds an entry saying: to reach 198.51.100.0/24, send traffic toward this neighbor, along a path of several ASes ending in 64500. If the company's link fails, the carrier withdraws the announcement, and routers elsewhere fall back to any other path they know, or lose the route entirely. This convergence process can take seconds to minutes, which is why internet outages are rarely instantaneous or uniform.

How the address ranges BGP advertises are actually carved up

Curious about the notation used to describe which IP ranges an AS advertises? CIDR notation is the underlying system that expresses these address blocks and their sizes concisely, and understanding it makes route advertisements much easier to read. A /24 contains 256 addresses, a /16 contains 65,536, and each bit you remove from the prefix length doubles the block. The global routing table now holds on the order of a million IPv4 prefixes, and routers must store all of them, which is one reason operators discourage announcing tiny or needlessly split blocks.

What actually carries the traffic across continents

BGP decides the logical path traffic should take, but something has to physically move data between continents -- undersea cables. Together, BGP's logical routing and the physical cable network are what make a single global internet possible. When a cable is cut, BGP is what re-routes traffic over the remaining links, though capacity may be strained on the alternatives.

Frequently Asked Questions

Does the router in my house use BGP?

No. Home and office internal networks typically run fine on static routes or a default gateway handed out by DHCP. BGP is used specifically by organizations with their own AS number -- carriers, cloud providers, and large enterprises -- to exchange route information with other organizations' networks.

Would an ordinary user notice a BGP hijack happening?

Usually not directly -- it just looks like a specific site suddenly getting slow or unreachable, without any obvious sign that BGP is the cause. It's typically network operators or security firms monitoring routes who identify, after the fact, that a BGP routing error was the root cause. Encrypted connections (HTTPS) limit what an attacker can do with hijacked traffic, but they do not stop the traffic from being diverted.

What is the difference between BGP and OSPF?

OSPF is an interior gateway protocol: it finds the shortest path within a single organization's network, using link costs. BGP is an exterior protocol: it exchanges reachability between organizations and chooses paths based largely on policy, such as business relationships, rather than pure speed. Large networks use both, with an IGP such as OSPF or IS-IS inside and BGP at the edge.

Is RPKI enough to make BGP secure?

It is an important step but not a complete one. RPKI origin validation prevents many accidental hijacks and simple malicious ones by checking who may originate a prefix, but it does not validate the full AS path, so more sophisticated path manipulation is still possible. Newer work on path validation exists, but deployment is limited, so RPKI is best viewed as one layer among several.