Chapter 50 — BGP: how the whole internet agrees on directions

Autonomous systems

   An AUTONOMOUS SYSTEM (AS) is one network under one administrative control,
   identified by a number (an ASN).

   AS15169 = Google        AS13335 = Cloudflare        AS3356 = Lumen

   BGP's job: let ASes tell each other which IP ranges they can reach.

BGP runs over TCP port 179 — so, unlike OSPF, the two routers must already be able to reach each other before BGP can start.

How it advertises

   "I can reach 93.184.216.0/24, and the path is: AS64500 AS3356 AS15133"
                \______________/                 \___________________/
                  the prefix                       the AS_PATH -- the list
                                                   of networks to traverse

The AS_PATH does two jobs:

1. Loop prevention — if a router sees its own ASN in the path, it rejects the route. Simple and effective.
2. A tiebreak — a shorter path is usually preferred.

The crucial insight: policy beats distance

When BGP has several paths to the same prefix, it walks a list of tiebreaks. The first four are what matter:

   1. Highest WEIGHT          (local to one router, vendor-specific)
   2. Highest LOCAL_PREF      <-- THE knob. Set by YOUR network's policy.
   3. Locally originated
   4. Shortest AS_PATH        <-- the famous one... but it's only FOURTH
   ... (several more, rarely reached)

LOCAL_PREF beats AS_PATH. In other words, a network will happily send your traffic along a longer path because that path is cheaper or contractually preferred.

This is why your packets sometimes cross a continent to reach a server two miles away. The internet's shape is commercial, not geographic.

Business relationships

   CUSTOMER   pays you        -> you advertise them to EVERYONE
   PEER       free exchange   -> you exchange only your own and your
                                 customers' routes
   PROVIDER   you pay them    -> they give you everything;
                                 you advertise only yourself and your customers

These relationships, encoded as routing policy, determine the actual path your packets take.

Influencing traffic (and the asymmetry)

   OUTBOUND (traffic you send)      -> YOU control it easily.
        Set LOCAL_PREF higher on routes from your preferred provider.

   INBOUND (traffic sent to you)    -> you can only HINT.
        * AS-path prepending: advertise with your own ASN repeated,
          making the path look longer and less attractive
        * ask your provider for a "community" tag that adjusts their policy
        * advertise a MORE SPECIFIC prefix out one link
          (longest-prefix match beats every BGP attribute)

You cannot force inbound path selection, because the remote network's own LOCAL_PREF is evaluated before your prepending. This asymmetry frustrates everyone who multihomes for the first time.

The three ways BGP breaks the internet

1. Prefix hijack. An AS announces address space it doesn't own. Because longest-prefix match wins (Chapter 13), announcing a /24 inside someone's /16 pulls their traffic globally. This has taken down YouTube (2008) and been used to steal cryptocurrency by hijacking DNS providers.

2. Route leak. An AS accidentally re-announces routes it shouldn't — becoming an unintended transit for traffic it can't carry. Usually a filter mistake; usually causes congestion and blackholes rather than theft.

3. Instability. A flapping link generates updates that ripple globally.

The defences

# who announces this prefix, and through which path?
curl -s "https://stat.ripe.net/data/prefix-overview/data.json?resource=1.1.1.0/24" \
  | python3 -m json.tool | head -30

# what prefixes does an AS announce?
whois -h whois.radb.net -- '-i origin AS13335' | grep -c '^route:'

# see the AS path your own traffic takes
traceroute -A 1.1.1.1          # -A shows the ASN at each hop
mtr -z 8.8.8.8                  # -z also shows ASNs

# is a prefix RPKI-valid?
curl -s "https://stat.ripe.net/data/rpki-validation/data.json?resource=AS13335&prefix=1.1.1.0/24" \
  | python3 -m json.tool | grep -i status