The internet is a monster.
BGP is how it finds its way.
Around seventy-five thousand networks announce who they are and how to reach them. Every packet you send follows a path someone agreed on — hop by hop, AS by AS. Here is how that deal gets made.
01 · the ideaWhat is BGP, really?
The internet is not one network. It is tens of thousands of autonomous systems — ISPs, clouds, universities, your employer — each with its own number (ASN) and its own opinions. BGP is the protocol they use to tell each other which addresses they can reach, and through whom.
Paths, not distances
Every route carries the full list of ASes it crossed. A router that sees its own ASN in that list throws the route away — that is how BGP avoids loops.
Money beats metrics
Routers do not simply pick the shortest path. They pick the one their operators prefer: customers over peers, peers over transit providers. BGP is business logic with packets.
Tell only what changed
After the initial table dump, neighbors exchange only UPDATEs: new routes, changed attributes, withdrawals. A quiet session is just KEEPALIVEs every few seconds.
02 · on the wireAnatomy of an UPDATE
This is what one route looks like when it arrives. Hover the attributes — each one is a lever operators pull to steer traffic.
# BGP UPDATE received from 198.51.100.1 (AS64500), 4-byte ASN capable NLRI 203.0.113.0/24 ORIGIN IGP AS_PATH 64500 64510 64511 NEXT_HOP 198.51.100.1 LOCAL_PREF 200 MED 10 COMMUNITIES 64500:120 64500:3001 LARGE_COMM 64500:1:840 # → installed as best path; 2 alternates kept in Adj-RIB-In
03 · decisionsHow a router picks the best path
When several neighbors offer the same prefix, a router walks this list top to bottom and stops at the first difference. Details vary between vendors, but the spirit is universal.
- Is the next hop reachable?
A route through a black hole is not a route. - Highest LOCAL_PREF
Our own policy comes first: customers, then peers, then transit. - Locally originated routes
What we announce ourselves beats what we heard. - Shortest AS_PATH
Fewer networks in the middle, fewer things to go wrong. - Lowest ORIGIN
IGP before EGP before INCOMPLETE. - Lowest MED
Only between routes learned from the same neighboring AS. - eBGP over iBGP
Leave the network as early as possible — "hot potato". - Closest next hop
Lowest IGP metric to the exit. - Tie-breakers
Oldest route, then lowest router ID, then lowest neighbor address.
04 · try itRoute explorer
Pick a prefix and watch the monster pick a path through a small, entirely made-up internet. Every ASN and prefix here is reserved for documentation, so nothing real gets hurt.
Simulated with documentation ASNs 64496–64511 (RFC 5398) and prefixes from RFC 5737 / RFC 3849.
Session state machine
Before any route moves, two routers have to become friends. Watch a session come up:
TCP handshake on port 179, OPEN messages with ASN and hold time, KEEPALIVE to confirm — then the table flows.
05 · monsters under the bedWhen BGP goes wrong
BGP trusts by default. Most of the time that is fine. Sometimes a single typo reroutes a continent.
Route leak
A network re-announces routes it learned from one provider to another, turning itself into accidental transit for traffic it cannot carry.
Prefix hijack
Someone announces address space that is not theirs — or a more specific slice of it. More specific wins, so traffic quietly follows the lie.
Route flapping
A link that goes up and down makes routers across the world recompute over and over. Damping helps, sometimes too much.
Fat fingers
Prepending your ASN a hundred times instead of three, or forgetting a filter during a midnight change window. Classic.
Signed origins
Resource owners sign which ASN may originate their prefixes; routers drop announcements that do not match.
Valley-free paths
ASPA records and BGP roles (RFC 9234) let routers spot paths that no sane business relationship would produce.
Filters and limits
IRR-based prefix filters, max-prefix limits and never accepting the whole table from a customer. Boring, effective.