BGP: who decides how traffic travels between networks?

Welcome to the International Highway Managers' Congress! Road owners from across the world are sitting at one enormous table. Each has their own map, their own rules and an unshakeable belief that their route is the best. Somewhere far away, a driver simply wants to reach a destination. How on earth does the whole Internet avoid becoming one enormous traffic jam? Meet BGP.

Everybody owns a highway. And everybody knows best

Several road managers take their seats in a conference hall. Each has a number instead of a nameplate.

— Ladies and gentlemen, I hereby open the International Road Managers' Congress — announces the chair.
— Why does my badge say 64501 instead of my name?!
— That's your Autonomous System number.
— MY WHAT?!
— A network managed under its own routing policy.
— So I'm independent?!
— Broadly speaking.
— AND I CAN DO WHATEVER I LIKE?!
— Within your network, subject to the arrangements you've made.
— THEN WHY DO I HAVE NEIGHBOURS?!

🤣🤣

The Internet isn't one gigantic network run by one manager. It's made up of many independently managed networks. A network, or group of networks, operating under a shared routing policy is called an AS — Autonomous System. Each AS has an identifier called an ASN.

64501 is an example from the private ASN range. Real public Internet operators can use publicly assigned AS numbers.

BGP — Border Gateway Protocol lets autonomous systems exchange information about which IP address ranges they can reach. It isn't a central GPS for the whole world. Think of it as a collection of agreements between road managers.

You can reach Warsaw through me!

The first manager stands up.

— Ladies and gentlemen! You can reach Warsaw through my network!
— How do you know?
— The road to Warsaw is in my network!
— And I can get there through him! — shouts a neighbour.
— And I can get there through that neighbour!
— AND I CAN GO THROUGH THE ONE AFTER THAT!
— GENTLEMEN! — the chair bangs the table. — THIS IS NOT A COMPETITION FOR THE LONGEST WAY TO WARSAW!

🤣

BGP advertises IP prefixes: groups of IP addresses. An announcement can be understood as “I know how to deliver packets to 203.0.113.0/24”. That's a documentation-only example, not an actual route to Warsaw.

A neighbouring network may accept the announcement and, if its policy allows, pass it along. Reachability information can therefore travel through many independently managed networks.

But an announcement isn't a promise that every vehicle gets a green light. Each operator decides which announcements to accept and which to export.

AS_PATH: a list of managers along the way

Two proposed routes appear on the screen.

— Mine goes through AS 64502, 64503 and 64504!
— Mine goes through 64505 and 64504!
— MY ROUTE IS BETTER!
— WHY?!
— Because my map is in colour!

AS_PATH is a BGP attribute containing information about the Autonomous Systems that an advertisement has traversed. Roughly speaking, it tells us which networks lead towards the announced prefix.

It also helps prevent loops between autonomous systems. If an AS sees its own number in a received AS_PATH, it normally rejects that route.

— Boss! Our route has come back to us!
— Fantastic! That means it works!
— No. It goes through us and comes back to us.
— THEN LET'S SEND IT AROUND AGAIN!
— THAT'S EXACTLY WHAT AS_PATH IS MEANT TO PREVENT!

🤣🤣

Remember: the number of AS entries isn't a measure of kilometres, routers or latency. It's a different kind of information.

Shortest? Fastest? No — whatever policy says!

Two maps lie on the table. The first route crosses two countries, the second five.

— We're taking the one through two! — declares the manager.
— But the one through five has higher priority in our network.
— HIGHER?! IT GOES THROUGH FIVE COUNTRIES!
— Correct.
— THIS ONE ONLY GOES THROUGH TWO!
— Also correct.
— THEN WHY ARE WE TAKING THE LONG ONE?!
— BGP isn't ordinary navigation that simply chooses the shortest road.
— THEN WHAT KIND OF NAVIGATION IS IT?!
— Business navigation, boss.

🤣🤣

BGP is driven by routing policy. Operators can prefer particular neighbours, reject advertisements, modify attributes and choose how to route traffic. Selection isn't simply a question of kilometres, latency or the fewest routers. Different BGP implementations have detailed best-path selection procedures.

One important attribute is LOCAL_PREF, a preference used inside an AS. A higher value usually indicates a preferred route within that operator's network and may take priority over a shorter AS_PATH.

— Why are we using neighbour A?
— Because it has a higher LOCAL_PREF.
— Who set that?
— You did.
— WHEN?!
— Yesterday.
— WHY?!
— You said, “Send everything this way because I say so”.
— AH. THEN IT MUST BE A GOOD ROUTE.

🤣

A route can look shorter on paper and still lose to another one. That's BGP: where you can go matters, but so does whose policy gets to decide.

BGP peers: you can't just walk in and shout

A late attendee rushes into the conference waving sheets of paper.

— HELLO! I CAN GET YOU TO WARSAW TOO!
— With whom have you established a BGP session? — asks the chair.
— A WHAT?!
— Which configured neighbour exchanges routes with you?
— NOBODY! I JUST WALKED IN AND STARTED TALKING!
— Sir, this isn't a residents' association meeting.

🤣

BGP exchanges information between configured neighbours, often called peers. Routers establish a session, normally using TCP port 179, and then exchange routing information. They don't blindly broadcast announcements to every device on the Internet.

If a peer session goes down, routes learned only through that session generally stop being available, and the router considers alternatives according to its policy.

eBGP and iBGP: speaking to neighbours and your own office

The manager phones his company's headquarters from the congress.

— Hello! I've learned a new route from our neighbour!
— Tell our other branches.
— ISN'T THAT TREASON?!
— No. They're part of the same company.
— And who was I talking to just now?
— An outside operator.
— DAMN IT! AND BOTH THINGS ARE CALLED BGP?!

🤣

eBGP exchanges BGP routes between different autonomous systems, such as two Internet providers. iBGP exchanges BGP information inside one AS, helping different routers in that operator's network learn the routes they need.

Large iBGP networks require careful design. Without additional mechanisms such as route reflectors, we can't assume any router will freely redistribute all learned iBGP routes to every other router. That's a topic for another committee meeting.

NEXT_HOP: which neighbour gets the first truck?

The manager proudly presents a route across half a continent.

— I know every country we'll pass through!
— Excellent. Who gets the truck first?
— ...
— Which neighbour? Which exit?
— GENTLEMEN, I HAVE JUST PLANNED THE ENTIRE CONTINENT AND YOU'RE ASKING ME ABOUT THE FIRST TURN?!

🤣

The NEXT_HOP attribute identifies the address of the next forwarding point for a BGP route. The router needs a usable way to reach that address through its own routing table. An impressively advertised destination doesn't help when the first next hop is unreachable.

These are two different jobs: BGP helps determine reachability and the chosen route, while the forwarding system still has to get packets to the appropriate next router.

Who pays for the motorway? Operators have agreements

The accountant walks into the conference room.

— Sorry, but why are we carrying everyone else's cars on our toll motorway for free?!
— Our colleague asked nicely!
— Do we have an agreement?
— No.
— THEN PLEASE INTRODUCE YOURSELF TO THE INVOICING DEPARTMENT!

🤣

Internet networks have business relationships. With transit, one operator provides another with reachability to more distant networks. With peering, networks exchange traffic directly under agreed terms. The commercial arrangements and reachability offered aren't necessarily the same.

That's why operators filter which prefixes they'll accept or pass along. Not every neighbour gets to use our network as a free motorway to every other neighbour.

— So not everybody is allowed to advertise everything?
— Exactly.
— EVEN IF THEY ASK VERY POLITELY?!
— Even then.

AS_PATH prepending and MED: polite suggestions to neighbours

The manager wants drivers from abroad to use one of his entrances less frequently.

— Can we tell them our road is long?
— You can make the AS_PATH look longer by repeating your AS number in the advertisement.
— IS THAT ALLOWED?!
— It's a common technique called AS_PATH prepending.
— So they'll definitely pick another road?
— Not necessarily.
— WHAT DO YOU MEAN, NOT NECESSARILY?!
— Their policy decides. You don't control the whole Internet.

🤣🤣

Prepending may make a route less attractive because of AS_PATH length, but there are no guarantees — other attributes and policies can outweigh it.

Another attribute, MED (Multi-Exit Discriminator), can suggest a preferred entry point to a neighbouring AS when multiple connections exist. Again: a suggestion, not an order binding every operator.

— Boss, the neighbour ignored our suggestion!
— SEND THE SAME SUGGESTION IN A BIGGER FONT!
— That's not how it works.

There and back again: two different decisions

A company representative draws an arrow from Warsaw to Kraków.

— This is where we'll send our cars!
— And how will they get back?
— THE SAME WAY!
— Not necessarily. Other networks make their own return-route decisions.
— BUT I DREW ONE ARROW!
— Exactly, boss. One arrow. One direction.

BGP doesn't guarantee symmetric paths. Your outbound traffic is strongly influenced by your own route preferences and available paths. Inbound traffic depends on decisions made elsewhere. Prepending and MED may influence other operators, but don't grant complete control over them.

That's essential during troubleshooting: the outgoing packet and returning reply may take different routes.

Withdraw the route! The bridge has collapsed!

A breathless clerk runs into the conference hall.

— BOSS! THE BRIDGE HAS COLLAPSED!
— WHICH BRIDGE?!
— THE ONE EVERYBODY USES TO GET TO WARSAW!
— PUT UP A SIGN SAYING “NO BRIDGE”!
— But foreign drivers don't know about it!
— THEN TELL THEM!
— THAT'S WHAT WE HAVE BGP FOR!

🤣🤣

BGP supports route withdrawals. When a prefix is no longer reachable through a path, a router can notify neighbours. They recalculate their choices and may pass the change further. This process of finding a new stable routing state is known as convergence.

It isn't always instantaneous. Failure detection, session behaviour, topology, filters, alternative paths and routing mechanisms all matter.

— How long will it take?!
— It depends.
— ON WHAT?!
— Configuration and how quickly everybody learns the news.
— CAN'T YOU JUST SAY “DONE”?!
— I could. But it wouldn't be true.

BGP hijacking: a self-appointed manager of Warsaw

The conference doors burst open. A stranger enters holding a map.

— FROM NOW ON, EVERY ROAD TO WARSAW GOES THROUGH ME!
— Who are you?
— The manager of Warsaw.
— But Warsaw is in a different network!
— NOT ANY MORE!
— WHAT DO YOU MEAN?!
— BECAUSE I JUST ANNOUNCED IT!

🤣🤣

BGP hijacking is the mistaken or unauthorised announcement of reachability for someone else's prefix. If other networks accept it, traffic may be misdirected, intercepted or dropped.

Simply shouting “Warsaw is mine” doesn't automatically take over the entire Internet. The result depends on other operators' filters, policies and security measures. Not every bad advertisement is a deliberate attack: configuration mistakes happen too.

RPKI and ROA: show us your authorisation

The chair studies the self-appointed manager.

— Documents, please.
— WHAT DOCUMENTS?!
— Proof that your AS may originate this prefix.
— I HAVE A BUSINESS CARD!
— That's not an ROA.
— WHAT ABOUT A RUBBER STAMP?!
— Still no.
— DAMN IT! MUST ALL OF YOU CHECK EVERYTHING?!

🤣🤣

RPKI (Resource Public Key Infrastructure) and ROAs (Route Origin Authorizations) help validate whether a given ASN is authorised to originate a particular prefix, including a specified maximum prefix length. Operators can use the validation result to reject some invalid advertisements.

Important limitation: ROAs primarily validate route-origin authorisation; they do not authenticate every AS along the AS_PATH. Route-origin validation is valuable, but doesn't solve every BGP security problem. Sensible filtering and good operational practices remain essential.

What BGP does — and what it doesn't

The manager receives a cheat sheet.

BGP does: exchange IP prefix reachability information; support policies for selecting and propagating routes; connect independently managed networks; and help respond to route withdrawals. BGP does not promise: the shortest road in kilometres, the lowest ping, the same return path or that every advertisement is truthful.

— So BGP doesn't drive the cars itself?
— No. It helps routers learn which paths are available and preferred.
— THEN WHO DRIVES THE CARS?!
— Routers forwarding packets.
— AND THEY READ OUR CONFERENCE RESOLUTIONS?!
— In a way, their routing tables reflect the results of those decisions.

Finale: the world's strangest road system

After six hours of negotiations, the chair announces success.

— Ladies and gentlemen! We've agreed on route-exchange rules!
— BRILLIANT! So everybody takes the shortest road now?!
— No.
— The fastest?!
— Not necessarily.
— The cheapest?!
— Depends for whom.
— THEN WHICH ONE?!
— The one permitted by operator policy.

The manager stares at the map for a long moment.

— So the Internet works because thousands of independent networks exchange reachability information and somehow manage to cooperate?
— More or less, yes.
— AND THEY ACTUALLY COOPERATE?!
— Most of the time.
— THAT'S THE MOST UNBELIEVABLE THING I'VE HEARD ALL DAY!

🤣🤣🤣

The International Highway Managers' Congress will reconvene once everyone agrees on a route to the next meeting. Due to conflicting BGP policies, the date remains unknown.