What Is BGP? How Internet Routing Actually Works

BGP (Border Gateway Protocol) is the routing protocol that makes the internet work. It's responsible for determining how data travels between Autonomous Systems (ASes) — the large networks operated by ISPs, cloud providers, and enterprises that make up the internet.

If DNS is the "phonebook of the internet," BGP is the "postal routing system." It doesn't carry your data — it determines the path your data takes across networks to reach its destination. Every time you visit a website, BGP has already determined the route your packets will follow across potentially dozens of networks.

BGP is sometimes called the "protocol that holds the internet together," and for good reason — without it, networks would have no way to share routing information, and the internet would fragment into isolated networks.

BGP works by having routers at the border of each Autonomous System exchange route announcements with their neighbors:

1. Route advertisement: An AS announces the IP prefixes (address ranges) it owns to its BGP neighbors. For example, AS15169 (Google) announces that it owns 8.8.8.0/24.
2. Route propagation: Each neighbor passes this announcement to its own neighbors, adding its own AS number to the path. This creates the "AS path" — a chain showing every network the route has passed through.
3. Path selection: When a router has multiple paths to the same destination, BGP uses a series of criteria to choose the best one: local preference, shortest AS path, origin type, and other attributes.
4. Continuous updates: BGP routers constantly exchange updates as routes change — new routes are announced, withdrawn routes are removed, and path attributes are modified.

Unlike internal routing protocols (like OSPF), BGP is a "policy-based" protocol. Network operators configure BGP to implement business decisions — preferring certain paths, blocking others, and controlling who they share routes with.

eBGP (External BGP): Used between routers in different Autonomous Systems. This is the "internet glue" — eBGP sessions connect ISPs to ISPs, cloud providers to enterprises, and content networks to access networks. eBGP sessions are typically configured over direct physical links between networks at internet exchange points or private peering connections.

iBGP (Internal BGP): Used within a single Autonomous System to distribute external routes to internal routers. When an edge router learns a route via eBGP, it uses iBGP to share that route with other routers inside the same AS. This ensures all routers in the network have consistent routing information.

The distinction matters because eBGP is where routing policy decisions are made — you choose which routes to accept from external networks and which of your routes to share with them.

Because BGP is fundamentally trust-based — routers generally believe the route announcements they receive — mistakes and attacks can have massive consequences:

BGP hijacking: A network announces IP prefixes it doesn't own, diverting traffic meant for someone else. In 2018, a small ISP briefly hijacked Amazon's DNS traffic. In 2008, Pakistan Telecom accidentally hijacked YouTube's IP space while trying to block it domestically, causing a worldwide YouTube outage.

Route leaks: A network accidentally shares routes it shouldn't, causing traffic to flow through unintended paths. In 2019, a small ISP in Pennsylvania leaked routes from Cloudflare through its network, causing widespread slowdowns.

Configuration errors: A simple typo in a BGP configuration can cause an AS to withdraw its routes, making its entire network unreachable. In October 2021, Facebook accidentally withdrew its BGP routes, making Facebook, Instagram, and WhatsApp unreachable for six hours.

RPKI (Resource Public Key Infrastructure) is a security framework designed to prevent BGP hijacking by cryptographically verifying that an AS is authorized to announce specific IP prefixes. Adoption is growing but still incomplete.

Even though most people never interact with BGP directly, it affects everyone:

• Internet outages: Major outages at large providers are often caused by BGP issues. Understanding BGP helps you understand why "the internet is down" sometimes affects only certain sites or services.
• Latency and performance: BGP path selection determines which networks your data traverses. Suboptimal BGP routing can add latency. CDNs and large tech companies spend significant effort optimizing their BGP configurations.
• IP reputation: The ASN associated with your IP (visible when you look it up on LookMyIP) reflects which network your traffic is routed through, which affects how your traffic is perceived by firewalls and email servers.
• Security: BGP hijacking can redirect your traffic through malicious networks, enabling surveillance or man-in-the-middle attacks. Using HTTPS protects your data even if BGP routing is compromised.

When a router learns several routes to the same prefix, it runs a fixed decision process and stops at the first step that produces a single winner. Knowing the order explains why traffic goes where it goes.

1. Highest weight — Cisco-proprietary, local to one router, never advertised.
2. Highest local preference — the main tool for controlling *outbound* traffic. Advertised within your AS, so the whole network agrees on which exit to prefer. Default is 100.
3. Locally originated routes — anything this router injected itself.
4. Shortest AS path — the famous one, and only the fourth tiebreaker.
5. Lowest origin type — IGP beats EGP beats incomplete.
6. Lowest MED — a hint to a neighbouring AS about which of several links into you it should prefer. Comparable only between routes from the same neighbouring AS, and frequently ignored.
7. eBGP over iBGP.
8. Lowest IGP metric to the next hop — "hot potato" routing: hand traffic off at the nearest exit.
9. Oldest route — a stability tiebreaker, preferring what is already working.
10. Lowest router ID.

The practical summary is that local preference controls what you send, and AS path prepending is your crude tool for influencing what you receive. The asymmetry is fundamental: you have complete authority over your outbound traffic and almost none over inbound, because inbound decisions are made by other people's routers according to their policies.

This is also why internet routing is so often asymmetric. Traffic from you to a destination may take an entirely different path than the return traffic, because two different networks made two independent decisions. Anything that assumes symmetric paths — some stateful firewalls, some traffic-analysis tooling — misbehaves as a result.

A hijack is announcing address space you do not hold. A route leak is propagating routes you legitimately learned to a party who should never have received them. Leaks are far more common, almost always accidental, and can be just as damaging.

The canonical form is a multihomed customer that accidentally re-announces routes learned from one transit provider to another. Suddenly a small regional ISP appears to offer a short path between two tier-one networks, and traffic from a large part of the internet attempts to flow through a network with a fraction of the necessary capacity. Everything congests.

Level 3 / Comcast, 2017. A configuration error in Level 3's network leaked routes and caused widespread outages across the United States for roughly 90 minutes.

Verizon / Cloudflare, 2019. A small Pennsylvania steel company running a BGP optimiser leaked routes to Verizon, which accepted them without filtering. Cloudflare, Amazon and Linode all saw significant traffic loss. Cloudflare's public postmortem noted that basic prefix filtering by Verizon would have prevented the entire incident.

The defences are unglamorous and effective:

Prefix filtering. Accept from a customer only the prefixes they have registered in an IRR database. This one control prevents the large majority of leaks.

Maximum prefix limits. Configure a ceiling on how many routes a peer may send, and tear the session down if exceeded. A leak of hundreds of thousands of routes then becomes a dropped session rather than a global incident.

AS path filtering. Do not accept routes from a customer whose AS path contains a tier-one network, since that pattern is definitionally a leak.

RFC 9234 role signalling. Newer BGP implementations let peers declare their relationship — provider, customer, peer — so the protocol itself can detect and reject leaks automatically.

You can watch this happening in real time through BGPStream, Cloudflare Radar or RIPEstat, all of which publish live and historical routing anomaly data.

BGP is designed for policy and scale, not speed. Convergence — the time for the whole internet to agree on a new set of paths after a change — is measured in minutes rather than milliseconds, and several mechanisms deliberately slow it further in exchange for stability.

MRAI (Minimum Route Advertisement Interval) rate-limits how often a router may send updates about the same prefix, traditionally 30 seconds for eBGP. This batches changes and prevents a flapping link from generating a continuous stream of updates, at the cost of slower propagation.

Route flap damping goes further, penalising prefixes that change repeatedly and suppressing them entirely once a threshold is exceeded. The penalty decays exponentially, so a stable prefix is reinstated after a few minutes. Damping was widely deployed in the 2000s, then largely disabled after research showed the default parameters suppressed legitimate routes far too aggressively; RIPE now recommends much more permissive settings if it is used at all.

BFD (Bidirectional Forwarding Detection) is the counterweight. Default BGP hold timers are 180 seconds, which means a peer can be dead for three minutes before the session drops. BFD detects link failure in milliseconds and signals BGP immediately, cutting failover from minutes to under a second. It is the single most valuable addition to a multihomed setup.

Graceful restart allows a router to keep forwarding traffic using its existing table while its BGP process restarts, preventing a control-plane restart from becoming a data-plane outage.

The practical consequence for anyone operating a multihomed network: failover is not instant, and testing it is the only way to know how long yours actually takes. Pull a cable during a maintenance window and measure. Most operators are surprised the first time.

Do I need BGP for my business?

Only if you need provider-independent addressing and automatic failover between multiple transit providers. That means running your own ASN, holding your own address space, and having someone who can operate it. For most organisations, redundancy is better achieved with a CDN, a cloud load balancer, or DNS-based failover — all of which are dramatically simpler and cover the realistic failure modes.

Why does traffic between two nearby cities route through another country?

Because BGP selects on AS path length and business policy, not geography or latency. If two regional ISPs have no direct interconnect, their traffic meets wherever both have a presence — frequently a major exchange hundreds of miles away. It is an economic outcome, not a technical necessity.

How long does BGP take to converge after a failure?

Typically 30 seconds to a few minutes globally, depending on MRAI timers and how far the change has to propagate. Within a single AS running BFD, sub-second. The gap between those two numbers is why globally distributed anycast is preferred over BGP failover for services that cannot tolerate a minute of disruption.

Can I see BGP data without running a router?

Yes. RIPE RIS, RouteViews, BGPStream and Cloudflare Radar all publish live and historical data. Most transit providers also run public looking glasses that let you query their routing table from a web page.

What happens if two networks announce the same prefix?

Routers choose according to the selection algorithm, so different parts of the internet may reach different destinations for the same address — the defining symptom of a hijack. If one announcement is more specific, it wins everywhere regardless of path length, because longest-prefix match is applied before any BGP policy. This is why hijacks typically use a more specific prefix.