BGP and Internet Routing: ASes, Policy & RPKI

BGP and Internet Routing

The internet is a network of networks — tens of thousands of independently operated autonomous systems (ASes): ISPs, cloud providers, CDNs, universities, and enterprises. The Border Gateway Protocol (BGP) is how they tell each other which IP address ranges they can reach. Every packet you send across the internet follows paths chosen by BGP, and when BGP goes wrong — a misconfigured announcement, a leaked route, a withdrawn prefix — large parts of the internet can become unreachable within minutes.

Most developers never configure a BGP router, but BGP still shapes their systems: it is how anycast DNS and CDNs route users to the nearest location, how cloud regions connect to on-premises networks, why some users see high latency or cannot reach a service, and how major outages unfold. Understanding the basics — announcements, policy, path selection, and validation — makes routing incidents diagnosable instead of mysterious.

TL;DR

Each network is an autonomous system with an ASN; it announces the prefixes it originates and propagates others' routes by policy.
eBGP runs between ASes; iBGP distributes external routes inside one AS.
Routes carry path attributes — AS_PATH, NEXT_HOP, LOCAL_PREF, MED, communities — used for best-path selection and policy.
Business relationships drive routing: transit (paid upstream), peering (settlement-free exchange), often at internet exchanges.
Filter what you send and accept: prefix lists, max-prefix limits, and RPKI route origin validation reduce leaks and hijacks.
Diagnose with looking glasses, route collectors (RIPE RIS, RouteViews), RPKI validators, and traceroute/mtr.

Quick Example

An FRRouting configuration announcing one prefix to a transit provider, with outbound and inbound policy:

Investigating a prefix from the outside:

The addresses and AS numbers in the configuration come from documentation ranges reserved for examples.

Core Concepts

Autonomous Systems and Prefixes

An AS is a network under one administrative routing policy, identified by a 16- or 32-bit ASN assigned by a regional internet registry (RIR) such as ARIN or RIPE NCC. ASes announce prefixes — blocks of IP addresses such as 203.0.113.0/24 — that they originate. Routers forward packets using the longest matching prefix, so a more specific announcement (/24) wins over a broader one (/16) — the property both traffic engineering and hijacks exploit. Most networks filter IPv4 announcements more specific than /24 and IPv6 more specific than /48. See IP Addressing, Subnets, and IPv6.

Sessions: eBGP and iBGP

BGP runs over TCP port 179 between configured neighbors. eBGP sessions connect different ASes, usually directly connected routers. iBGP sessions carry external routes between routers inside one AS; because iBGP does not re-advertise iBGP-learned routes, large networks use route reflectors instead of a full mesh. An interior gateway protocol (OSPF or IS-IS) handles reachability inside the AS.

Path Attributes and Best-Path Selection

Routers choose one best path per prefix through an ordered list of rules — highest LOCAL_PREF, shortest AS_PATH, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP cost to the next hop, then tie-breakers. Operators steer outbound traffic with LOCAL_PREF and influence inbound traffic with AS_PATH prepending, MED, more-specific announcements, and communities.

Transit, Peering, and Internet Exchanges

Transit providers sell access to the whole internet; peering is the settlement-free exchange of each other's customer routes. Internet exchange points (IXPs) let many networks peer over a shared fabric, often through route servers. These relationships create the valley-free routing norm: routes learned from a peer or transit provider are passed to customers, not to other peers or providers. Violating that norm is a route leak.

Anycast

Announcing the same prefix from many locations makes BGP route each user to a nearby site — the foundation of public DNS resolvers, root servers, and CDNs. Withdrawing the announcement from one site shifts its traffic elsewhere. See CDN and DNS.

Routing Security

RPKI (Resource Public Key Infrastructure) lets address holders publish Route Origin Authorizations (ROAs) stating which ASN may originate their prefixes and up to what length. Networks performing route origin validation (ROV) drop announcements marked invalid. RPKI checks origins, not entire paths; work on path validation continues. The MANRS initiative collects baseline routing-security practices for operators.

Diagnosing Routing Problems

Confirm the symptom with traceroute or mtr from several vantage points, noting where paths diverge.
Check the prefix in route collectors and looking glasses (RIPEstat, bgp.tools, RouteViews) — who originates it, which paths exist, and when they changed.
Check RPKI status for the prefix and origin.
Look for recent withdrawals or new more-specifics and compare with expected announcements.
Contact the relevant network operators through their published contacts (PeeringDB lists many).

See Packet Capture and Network Diagnostics.

Best Practices

Filter in Both Directions

Announce only your own and your customers' prefixes, accept only what neighbors are expected to send, and set max-prefix limits on every session.

Publish ROAs and Validate Origins

Create ROAs for every prefix you announce, with correct maximum lengths, and enable route origin validation on your routers.

Monitor Your Prefixes

Alert on unexpected origins, more-specifics, or withdrawals of your prefixes from external route collectors.

Keep Out-of-Band Access

Ensure you can reach routers and internal tools when your own routes are withdrawn.

Common Mistakes

No Outbound Filter

ROAs With Overly Broad Max Length

Depending on In-Band Access

FAQ

What is BGP?

The Border Gateway Protocol, which autonomous systems use to exchange reachability information for IP prefixes and choose paths across the internet based on routing policy.

What is an autonomous system?

A network or group of networks under a single administrative routing policy, identified by an AS number, such as an ISP, cloud provider, or large enterprise.

What is the difference between a BGP hijack and a route leak?

A hijack announces prefixes the announcing network is not authorized to originate. A route leak propagates legitimately originated routes beyond their intended scope, violating routing policy.

What is RPKI?

A cryptographic framework that lets IP address holders publish which ASNs may originate their prefixes. Routers performing route origin validation can reject announcements that contradict these records.

Why should application developers care about BGP?

Because anycast, CDNs, cloud connectivity, and many large outages depend on it. Knowing how routing works helps diagnose regional reachability problems and latency issues.