NetworkPuzzles

BGP is one of those protocols that quietly keeps the Internet running. As network engineers, we usually spend most of our time configuring neighbors, advertising prefixes, or troubleshooting routing issues. Security, however, is often something we don’t think much about until something goes wrong.

I recently completed the BGP Security course from the RIPE NCC Academy, and I thought it would be useful to summarize the concepts that stood out to me. It’s a collection of the practical lessons I found most valuable, especially for engineers working in ISP or enterprise environments.

Why Doesn’t BGP Have Built-in Security?

One of the first things the course explains is something many engineers already know but rarely stop to think about: BGP was never designed to verify trust.

When BGP was introduced in the late 1980s, the Internet was much smaller than it is today. Only a limited number of organizations exchanged routing information, and there was a high level of trust between network operators. Because of that, BGP focused on scalability and flexibility rather than authentication or route validation.

That design hasn’t fundamentally changed.

When a router receives a BGP update from one of its neighbors, it doesn’t automatically verify whether that neighbor actually owns the advertised prefix. It also doesn’t validate whether the AS Path is legitimate or whether the route should even exist. If the route satisfies the local routing policy, the router accepts it and may advertise it to other neighbors.

In other words, BGP assumes that every neighbor is telling the truth.

Why Are BGP Incidents So Dangerous?

One thing I found particularly interesting during the course is how quickly routing information propagates across the Internet.

Whenever a router learns a new route, it advertises that information to other neighbors. Those neighbors may advertise it again, and within a very short period, the route can reach networks on completely different continents.

This is exactly what makes BGP so powerful. It allows the Internet to adapt quickly when links fail or new networks come online.

The downside is that incorrect routing information spreads just as efficiently.

A single wrong route advertisement can leave one network, pass through multiple providers, and eventually influence routing decisions in hundreds or even thousands of Autonomous Systems. That’s why a simple configuration mistake made by one engineer can sometimes affect services worldwide.

Not every BGP incident is the result of an attack. In fact, many well-known outages happened because of human error. But whether the problem is accidental or intentional, the impact can be very similar.

Common Types of BGP Incidents

During the course, three types of incidents appeared repeatedly: Prefix Hijacking, Route Leaks, and Misconfigurations. Although they are often mentioned together, they are actually different problems.

Prefix Hijacking

Prefix hijacking happens when an Autonomous System advertises an IP prefix that it isn’t authorized to originate.

Imagine that AS65001 legitimately owns the prefix 203.0.113.0/24. Under normal conditions, other networks learn that traffic for this prefix should be forwarded to AS65001.

Now imagine another AS (AS65050) starts advertising exactly the same prefix.

Without any additional validation mechanism, neighboring routers have no built-in way of knowing which announcement is correct. Depending on routing policies, some parts of the Internet may actually believe the incorrect advertisement and begin sending traffic toward AS65050 instead.

The result could simply be a loss of connectivity, but in more sophisticated attacks, traffic may be intercepted before being forwarded to its intended destination.

Origin Hijack:

AS-Path Hijack:

https://blog.cloudflare.com/enforce-first-as-bgp

Route Leaks

A route leak is slightly different.

In this case, the advertised routes are legitimate, but they are advertised to the wrong neighbors.

For example, imagine an ISP receives Internet routes from one upstream provider. Those routes are supposed to stay inside the ISP’s network or be advertised only to its customers. If the ISP accidentally advertises the entire routing table to another upstream provider, traffic may suddenly start taking completely unexpected paths.

Many large-scale Internet disruptions have been caused by route leaks rather than malicious attacks.

Misconfigurations

Probably the most common cause of BGP incidents is simple human error.

A missing prefix filter, an incorrect route map, or a typo in a routing policy can have consequences far beyond a single network.

Anyone who has managed BGP in production has probably made configuration mistakes at some point. Most are caught quickly because they stay within the local network. Occasionally, however, a mistake escapes into the global Internet before anyone notices.

One of the biggest lessons I took from the course is that good operational practices are just as important as security technologies. Many incidents could have been avoided with proper filtering and validation before routes were ever advertised.

Learning from Real Incidents

The course uses several well-known incidents to demonstrate why BGP security matters.

Probably the most famous example is the Pakistan Telecom and YouTube incident in 2008.

Pakistan Telecom attempted to block access to YouTube within its own country by advertising a more specific route for YouTube’s IP space. Unfortunately, that announcement escaped beyond its own network because an upstream provider accepted and propagated the route instead of filtering it.

Since BGP always prefers the most specific matching prefix, many networks around the world started sending YouTube traffic toward Pakistan Telecom instead of Google’s infrastructure. As a result, YouTube became unreachable for a significant portion of the Internet until the incorrect advertisement was withdrawn.

Another class of incidents discussed during the course involves large-scale route leaks. Unlike hijacking, these usually aren’t malicious. They’re often caused by routing policies that accidentally advertise routes to peers or providers that were never supposed to receive them. Once those announcements begin propagating, traffic patterns across the Internet can change dramatically, sometimes causing congestion, packet loss, or widespread outages.

These examples reinforce an important point: BGP usually behaves exactly as designed. The real problem is accepting and propagating routing information without sufficient validation.