The Fragility of Trust
BGP was designed in an era when the internet was a small community of trusted academic and government networks. It has no built-in authentication — a router will accept route advertisements from its peers largely on trust. This creates two categories of serious failures that have caused major internet outages.
BGP Route Leaks occur when an AS accidentally re-advertises routes it should not. A classic example: a small ISP (AS300) peers with two large transit providers (AS100 and AS200). AS300 is supposed to only advertise its own IP blocks to each provider. Instead, due to a misconfiguration, AS300 starts advertising AS100's routes to AS200 and vice versa. Suddenly, AS300 becomes a transit path between two massive networks it was never designed to handle. Traffic floods in, AS300's routers are overwhelmed, and large portions of the internet become unreachable or slow. This exact scenario caused a major global outage in 2019 when a small ISP in Pennsylvania accidentally leaked routes through Verizon.
BGP Hijacks are intentional or accidental cases where an AS announces IP prefixes it doesn't own. If AS999 announces 8.8.8.0/24 (Google's DNS range), some networks may route traffic destined for Google to AS999 instead. This can be used for traffic interception, spam, or simply causes connectivity failures. BGP hijacks have been used by nation-state actors to intercept traffic.
Mitigations:
- RPKI (Resource Public Key Infrastructure): A cryptographic system where IP address holders sign records (called Route Origin Authorizations, ROAs) stating which ASN is authorized to originate a given prefix. Routers that validate RPKI can reject routes from unauthorized origins. RPKI adoption has grown significantly since 2019 but is not yet universal.
- IRR Filtering: Network operators register their routing policies in Internet Routing Registries and filter incoming BGP advertisements against those records.
- Prefix filtering: Only accept routes of a reasonable size (e.g., reject anything more specific than /24 for IPv4) to limit the blast radius of leaks.
Key Point: BGP's trust model is its greatest vulnerability. RPKI is the primary cryptographic defense against route hijacks, but adoption is still incomplete across the global internet.