The Border Gateway Protocol (BGP) is the routing protocol that internet networks use to tell each other which IP address ranges they can reach, effectively deciding how traffic crosses the internet.
How BGP works
The internet consists of tens of thousands of autonomous systems (AS) – networks run by ISPs, cloud providers, universities and companies. Each AS announces the IP address prefixes it owns to its neighbours over TCP port 179, and routers pass these announcements on, choosing paths according to policy and path length. The current version, BGP-4, is defined in RFC 4271. The protocol was designed on the assumption of trust: by default, a router accepts whatever a peer announces.
Why BGP matters for security
Because announcements are not verified, mistakes or malicious actions can redirect traffic for entire services:
- Route leaks and hijacks – in 2008 Pakistan Telecom accidentally announced YouTube’s prefix while trying to block it locally, making YouTube unreachable worldwide for hours.
- Cryptocurrency theft – in 2018 attackers hijacked Amazon Route 53 address space to redirect DNS for the MyEtherWallet service and steal funds from users’ crypto wallets.
- Interception – a hijack can route traffic through an attacker’s network for a man-in-the-middle attack and then forward it on, making it hard to notice.
- Outages – in October 2021 a faulty configuration change withdrew Facebook’s BGP routes, taking Facebook, Instagram and WhatsApp offline for about six hours.
How to secure BGP
- Publish Route Origin Authorisations (ROAs) in RPKI and enable route origin validation on routers.
- Filter announcements from customers and peers using IRR data, following MANRS guidelines.
- Protect BGP sessions with TCP-AO or MD5 authentication and maximum-prefix limits.
- Monitor your prefixes with BGP alerting services and always use TLS so hijacked traffic cannot be read.
