BGP and Autonomous Systems: Routing You Can Trust
The Border Gateway Protocol holds the internet together by having tens of thousands of independent networks tell each other, on the honor system, which addresses they can reach. That honor system is the problem: BGP was designed for a smaller, more trusting internet, and for decades a single mis-origination could black-hole a country's traffic. The good news is that after years of slow-motion effort, the tooling to make routing verifiable is finally deployed at scale. Here's the current state of the art.
The model in one paragraph
An Autonomous System (AS) is a network under one administrative domain, identified by an AS number (ASN). BGP speakers exchange prefixes (blocks of IP space) annotated with path attributes — most importantly the AS_PATH, the list of ASes a route traversed. Routers pick a best path per prefix using a deterministic decision process (LOCAL_PREF, then AS_PATH length, and onward). eBGP runs between ASes; iBGP distributes those routes inside one.
The three ways routing goes wrong
- Prefix hijack. An AS originates a prefix it doesn't own. Traffic to that space is drawn toward the impostor — for outage, interception, or spam.
- Path manipulation. A more subtle hijack that forges a plausible
AS_PATHso the route looks legitimately sourced. - Route leak. A network re-announces routes in a direction that violates business relationships (e.g., leaking a provider's routes to another provider), often accidentally, often catastrophically.
The defense stack, as it actually stands in 2026
RPKI + ROV — the deployed baseline
Resource Public Key Infrastructure lets an address holder publish a signed Route Origin Authorization (ROA): "AS 64500 is authorized to originate 203.0.113.0/24, up to /24." Routers then perform Route Origin Validation (ROV), marking each received route Valid, Invalid, or NotFound and dropping Invalids. This is now majority-deployed across the default-free zone and stops the most common accidental and many malicious origin hijacks. Publishing ROAs for your space and dropping Invalids on your borders is table stakes.
ASPA — closing the path gap
ROV validates the origin but not the path. Autonomous System Provider Authorization (ASPA) is the RPKI object that fixes this: providers are declared, so routers can detect paths that violate valley-free routing and catch most route leaks and many forged-path hijacks. ASPA is the active frontier of deployment — worth designing for now.
BGPsec — cryptographic paths, rarely deployed
BGPsec signs the entire AS_PATH hop by hop, making forgery cryptographically detectable. It's the strongest guarantee and the least deployed, held back by hardware cost and the need for near-universal adoption to matter. Know it exists; don't wait for it.
Config that validates, not just routes
ROV on a route-server or edge router, dropping Invalids and preferring Valid (shown here in the widely used FRRouting/Cisco-style syntax):
! Enable RPKI-to-router (RTR) sessions to your validators
router bgp 64500
rpki
rpki cache 192.0.2.10 port 3323 preference 1
rpki cache 192.0.2.11 port 3323 preference 2
!
address-family ipv4 unicast
neighbor 198.51.100.1 route-map ROV-IN in
exit-address-family
! Drop Invalids outright; give Valid routes a local-pref nudge
route-map ROV-IN permit 10
match rpki invalid
set community no-advertise ! belt: don't propagate
! ...or simply: (no permit) to deny — cleanest is an explicit drop
route-map ROV-IN deny 15
match rpki invalid
route-map ROV-IN permit 20
match rpki valid
set local-preference 200
route-map ROV-IN permit 30 ! NotFound: accept, normal pref
Layer the classic hygiene underneath it: strict prefix filters and max-prefix limits on every eBGP session, bogon and RFC 1918 filtering, and TCP-AO (the modern replacement for the old TCP MD5) to authenticate the BGP session itself.
Verify from the outside
Validation is only as good as your monitoring. Query RPKI state and origins programmatically, and alert on your prefixes appearing with an unexpected origin:
import httpx # RIPEstat + Cloudflare/RIPE RPKI validator APIs
def check_origin(prefix: str, expected_asn: int) -> None:
r = httpx.get("https://stat.ripe.net/data/routing-status/data.json",
params={"resource": prefix}, timeout=10).json()
origins = {o["origin"] for o in r["data"]["origins"]}
if origins != {str(expected_asn)}:
alert(f"Unexpected origin for {prefix}: saw {origins}, "
f"expected AS{expected_asn}")
check_origin("203.0.113.0/24", 64500)Pair this with a BGP-monitoring service (BGPalerter, or a commercial route-monitoring feed) so a hijack pages you in minutes, not after customers notice.
BGP will always run partly on trust. Modern routing security is about shrinking the trust: sign your origins with ROAs, drop Invalids with ROV, adopt ASPA against leaks, and monitor as if none of it worked.