BGP (Border Gateway Protocol) is how the networks of the internet tell each other which addresses they can deliver traffic to. Without it, a customer of one provider couldn’t reach a server in another provider’s network.
Prefixes and AS paths
Every autonomous system announces the address blocks (prefixes) it originates. One NZ (AS9500), for example, announces 49.224.0.0/14. Neighbours pass the announcement on and add their own AS number to the AS path. A router elsewhere might see something like this (the transit networks here use documentation AS numbers, RFC 5398):
49.224.0.0/14 via AS64500 AS64501 AS9500
That is: go via two transit networks to One NZ (AS9500), the origin. The last AS in the path is always the origin.
How a path is chosen
A router chooses among possible paths by rules and policy: first the most specific route (a /24 beats a /16), then local preference (customers before peers before transit), shortest AS path and several tie-breakers. There is no central control; every network decides for itself.
When it goes wrong
BGP trusts what neighbours say by default, which leads to two well-known problems:
- Route leaks: a network passes on routes it shouldn’t, and traffic takes a detour.
- Route hijacks: someone announces a prefix that isn’t theirs, or a more specific prefix inside it, and draws the traffic.
RPKI: route origin validation
With RPKI, the holder of an address block can publish a signed ROA: “AS9500 may originate 49.224.0.0/14”. Networks that validate drop routes that contradict it. How many routes from New Zealand networks are covered by a valid ROA is shown on New Zealand’s internet in numbers.
Explore it yourself
- The BGP prefix lookup shows who announces a prefix, covering routes and more-specifics.
- The RPKI validator checks whether a route is valid.
- The ASN lookup shows everything an AS announces.