What Is BGP? The Internet Routing Protocol Explained

What Is BGP?

BGP (Border Gateway protocol) is the [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) protocol that makes the internet work. It is the system by which every network on the internet — from a small company to a major cloud provider — advertises which IP addresses it owns and learns how to reach every other network.

Without BGP, routers would not know how to forward packets beyond their own network, and the internet would cease to function as a global system.

Autonomous Systems (AS)

The internet is not one monolithic network — it is a collection of thousands of independently managed networks called Autonomous Systems (AS). Each AS:

• Is assigned a unique AS Number (ASN) by IANA-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) or regional registries (ARIN, RIPE, etc.)
• Controls one or more blocks of IP addresses
• Makes its own internal [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) decisions
• Uses BGP to communicate with other ASes

Examples:

• Google: AS15169
• Cloudflare: AS13335
• Deutsche Telekom: AS3320

How BGP Works

BGP routers (called BGP peers or BGP speakers) establish TCP-the-internets-core-protocol) sessions on port-ports-explained) 179 and exchange [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) information:

1. OPEN: Peers exchange capabilities and ASNs
2. UPDATE: Peer advertises new routes or withdraws old ones
3. KEEPALIVE: Regular messages to maintain the session-how-the-world-wide-web-works)
4. NOTIFICATION: Signal an error and close the session-how-the-world-wide-web-works)

BGP Advertisements

A BGP UPDATE message says: "I can reach these IP prefixes, and here is the AS path to get there."

AS15169 (Google) advertises:
  Prefix: 8.8.8.0/24
  AS Path: 15169

AS13335 (Cloudflare) advertises:
  Prefix: 1.1.1.0/24
  AS Path: 13335

Each AS that re-advertises a route prepends its own ASN to the path, creating an audit trail. When AS3320 re-advertises Google's prefix to AS5678, the AS Path becomes: 3320 15169.

iBGP vs eBGP

| | iBGP (Internal BGP) | eBGP (External BGP) | |---|---|---| | Between | Routers within the same AS | Routers in different ASes | | Purpose | Distribute external routes inside an AS | Exchange routes between ASes | | AS path | Not modified | AS number prepended |

Large networks run iBGP internally to distribute the full internet [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) table among their own routers, while using eBGP at their borders to connect to ISPs and peers.

BGP vs OSPF

| | BGP | OSPF | |---|---|---| | Scope | Between ASes (internet-wide) | Within an AS (internal network) | | Type | Path vector | Link-state | | Speed | Slow convergence (minutes) | Fast convergence (seconds) | | Scale | Internet (900,000+ routes) | Campus or enterprise | | Metric | Policy-based | Cost based on bandwidth |

OSPF is used inside a company network; BGP is used between your company and your ISP.

BGP Route Selection

When BGP has multiple paths to the same destination, it selects the best one based on a hierarchy of attributes:

1. Highest Local Preference (internal policy)
2. Shortest AS Path (fewer hops)
3. Lowest Origin type
4. Lowest MED (Multi-Exit Discriminator)
5. eBGP routes preferred over iBGP
6. Lowest IGP metric to the next-hop
7. Lowest router-network-address-translation-explained) ID (tiebreaker)

BGP Hijacking

BGP hijacking is one of the most serious threats to internet infrastructure. Because BGP peers trust each other by default, a malicious or misconfigured router-network-address-translation-explained) can advertise IP prefixes it does not own.

How a BGP Hijack Works

1. A malicious or misconfigured network announces: "I can reach 8.8.8.0/24" (Google DNS)
2. Neighbouring ASes accept the announcement and update their [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) tables
3. Traffic destined for Google DNS servers is redirected to the malicious network
4. The hijacker can intercept, drop, or analyse the traffic

Notable BGP Incidents

• 2010: China Telecom accidentally announced approximately 40,000 route prefixes, briefly [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) traffic through Chinese infrastructure
• 2018: An ISP in Nigeria rerouted Google traffic through China Telecom due to a BGP misconfiguration
• 2022: A BGP route leak affected Cloudflare, redirecting cryptocurrency traffic

BGP Route Leak

A route leak is a less malicious but still disruptive mistake where an AS re-advertises routes it received from one peer to another peer, creating suboptimal or incorrect [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3).

Securing BGP: RPKI

RPKI (Resource public key Infrastructure) is the primary defence against BGP hijacking:

• Regional Internet Registries issue cryptographic certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) binding IP prefixes to legitimate ASNs
• BGP routers check RPKI Route Origin Authorizations (ROAs) to verify that an AS is authorised to announce a prefix
• Invalid announcements are rejected

As of 2026, RPKI adoption has grown significantly but is not yet universal. Major ISPs and cloud providers including Cloudflare, Amazon, and Google have deployed it.

BGP in Practice: Peering and Transit

Networks connect to each other in two ways:

Transit: You pay an upstream ISP to carry your traffic to the internet. The ISP gives you access to all routes they know.

Peering: Two networks of similar size exchange traffic directly at Internet Exchange Points (IXPs) without payment. IXPs like DE-CIX (Frankfurt), AMS-IX (Amsterdam), and LINX (London) are physical locations where hundreds of networks peer with each other.

Summary

• BGP is the [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) protocol that interconnects all autonomous systems on the internet
• Every network that connects to the internet uses BGP to advertise its IP prefixes
• eBGP connects different ASes; iBGP distributes routes within an AS
• BGP hijacking is a critical vulnerability — a rogue AS can claim to own any IP block
• RPKI provides cryptographic validation of route origin to defend against hijacking
• BGP route selection uses a complex attribute hierarchy that operators tune for traffic engineering