What Is BGP?

In 2008, Pakistan tried to block YouTube. A government order led Pakistan Telecom to announce via BGP that it owned YouTube's IP addresses. Within minutes, that lie propagated across the Internet. YouTube went dark—not just in Pakistan, but worldwide. For nearly two hours, the Internet's routing system faithfully directed YouTube traffic to Pakistan, where it vanished into a black hole.

This is Border Gateway Protocol. The protocol that routes all Internet traffic between networks. The protocol with no built-in way to verify that anyone is telling the truth.

The Problem BGP Solves

The Internet isn't one network. It's over 70,000 independent networks—called autonomous systems—operated by ISPs, cloud providers, enterprises, universities, and governments. Each has its own equipment, policies, and business relationships. No central authority controls them.

Yet somehow, when you request a webpage from a server three continents away, your packets find their way there and back. They traverse networks operated by organizations that have never communicated directly, crossing boundaries between competitors, passing through infrastructure owned by dozens of different entities.

BGP makes this work. It's the common language that lets autonomous systems tell each other: "I can reach these IP addresses. Send traffic for them to me."

How BGP Works

BGP routers establish TCP connections with neighboring routers—sessions that can run for months or years. Through these sessions, they exchange route announcements.

A route announcement says:

• Prefix: "I can reach this block of IP addresses" (e.g., 8.8.8.0/24)
• AS Path: "Here's the chain of networks this route has passed through" (e.g., AS 15169 → AS 3356 → AS 701)
• Next Hop: "Send packets to this address to use this route"
• Attributes: Additional information for routing decisions

When Google (AS 15169) announces its IP addresses, the announcement propagates outward. Each network that receives it adds itself to the AS path and passes it along. Within minutes, routers worldwide learn: "To reach Google, send traffic this way."

This is elegant. It's also terrifying.

Trust Without Verification

BGP was designed in 1989, when the Internet was a small community of universities and research institutions. Everyone knew everyone. Trust was implicit.

That Internet no longer exists. But BGP still works the same way.

When Pakistan Telecom announced YouTube's IP addresses, BGP had no way to ask: "Do you actually own those addresses?" It simply propagated the announcement. Routers worldwide updated their tables. Traffic flowed to Pakistan.

This isn't a bug that can be patched. It's fundamental to how BGP operates. The protocol that routes all Internet traffic relies on networks telling the truth about which addresses they can reach—with no mechanism to verify their claims.

BGP is a handshake agreement among 70,000+ strangers, each trusting the others not to lie about where traffic should go.

The Path Selection Dance

When a router learns multiple routes to the same destination, it must choose. BGP's selection process considers, in order:

1. Local Preference: Routes your network has marked as preferred
2. AS Path Length: Shorter paths (fewer networks to traverse) win
3. Origin Type: How the route was learned
4. MED: Hints from neighbors about their preferred entry points
5. External over Internal: Prefer routes from outside your network
6. IGP Cost: Prefer closer exit points
7. Router ID: Final tiebreaker

This isn't about finding the "best" path in any objective sense. It's about policy. Networks choose routes based on business relationships, cost, performance requirements, and strategic preferences. The Internet routes traffic the way its operators want, not necessarily the way that's fastest or shortest.

Two Flavors of BGP

External BGP (eBGP) connects different autonomous systems. When routes cross an eBGP session, the sending network adds its AS number to the path. This creates the chain that shows where a route has been.

Internal BGP (iBGP) distributes external routes within an autonomous system. If your network has multiple border routers receiving external routes, iBGP ensures they all know about all the routes—so traffic can exit through the optimal point.

eBGP is how networks talk to each other. iBGP is how a network talks to itself about what it learned from others.

Policy Is the Point

BGP's attributes give operators precise control:

Local Preference controls outbound traffic. Set it higher for routes you prefer. Your network will send traffic that direction.

MED (Multi-Exit Discriminator) influences inbound traffic. Tell your neighbor which of your entry points to use. Lower values are preferred.

Communities are tags for flexible policy. Mark routes as "don't announce to peers" or "learned from customer" and implement policies based on those tags.

AS Path Prepending makes routes less attractive by artificially lengthening them. If you want traffic to avoid a particular path, prepend your AS number multiple times. The longer path loses in route selection.

This flexibility is why BGP works for the real Internet—where business relationships matter, where networks pay each other (or don't), where "best path" is a policy decision, not a technical measurement.

What Can Go Wrong

Route Hijacking: Announce someone else's IP addresses, accidentally or maliciously. Traffic meant for them comes to you. The Pakistan/YouTube incident was accidental. Others have been deliberate—cryptocurrency theft, traffic interception, denial of service.

Route Leaks: Accept routes you shouldn't re-announce, then announce them anyway. Suddenly traffic that should stay between two networks flows through yours instead. Major outages have resulted from route leaks.

Slow Convergence: When routes change, BGP can take minutes to stabilize. During convergence, different parts of the Internet have different ideas about how to reach destinations. Packets may loop, black-hole, or take bizarre paths.

Table Growth: The global routing table exceeds 900,000 entries and grows constantly. Routers must store and process this entire table. Hardware that was adequate five years ago struggles today.

Why It Still Works

Given these vulnerabilities, it's remarkable that BGP works at all. Yet it does—reliably enough that most people have never heard of it.

The answer is operational practice. Networks filter announcements, rejecting routes for address space they know doesn't belong to the announcer. They monitor for anomalies. They build relationships with peers and respond quickly when things go wrong. RPKI (Resource Public Key Infrastructure) is slowly adding cryptographic verification of route origins.

BGP's security comes not from the protocol but from the humans operating it—and from the simple fact that most organizations have no reason to lie about their routes.

The Internet's Fragile Foundation

BGP is why the Internet works. Every connection you make, every packet you send, relies on BGP routing to find its way.

It's also a reminder that the Internet isn't a designed system. It's an emergent one—tens of thousands of independent networks cooperating through a protocol that assumes they'll mostly tell the truth. When that assumption fails, traffic goes to the wrong place. Sometimes for minutes. Sometimes for hours.

The protocol that holds the Internet together is a trust system operating in an environment where trust cannot be verified. That it works as well as it does is either a triumph of human cooperation or an accident waiting to happen.

Probably both.