BGP Routing & Autonomous Systems: How BGP Works and How to Detect Route Hijacking

BGP Routing & Autonomous Systems: How BGP Works and How to Detect Route Hijacking

The Border Gateway Protocol (BGP) is the glue holding the global internet together. It is an exterior gateway protocol (EGP) designed to exchange routing and reachability information among Autonomous Systems (AS) on the internet.

Understanding BGP

Understanding BGP path attributes, peering agreements, and security vulnerabilities is critical for network engineers and infrastructure architects.

What is an Autonomous System (AS)?

An Autonomous System (AS) is a collection of IP networks and routers under single administrative control that presents a common routing policy to the internet.

Public ASNs

• Public ASNs: Assigned by Regional Internet Registries (RIRs like ARIN, RIPE, APNIC). Example: Cloudflare is AS13335, Google is AS15169.

Private ASNs

• Private ASNs: Range 64512–65534 (16-bit) and 4200000000–4294967294 (32-bit), used internally within data centers or SD-WAN overlays.

BGP Path Selection Criteria

When a router receives multiple BGP routes for the same destination IP prefix, it selects the best path based on attributes in this strict sequence:

1. Highest Weight (Cisco proprietary, local to router)
2. Highest Local Preference (Shared within Autonomous System)
3. Locally Originated Routes (via network or aggregate-address)
4. Shortest AS-Path (Number of Autonomous Systems traversed)
5. Lowest Origin Type (IGP < EGP < Incomplete)
6. Lowest MED (Multi-Exit Discriminator)
7. eBGP over iBGP
8. Lowest IGP Metric to Next-Hop
9. Lowest Router ID

BGP Route Hijacking

BGP route hijacking occurs when an unauthorized Autonomous System announces IP prefixes in BGP that it does not own.

Because standard BGP inherently trusts announcements from peers:

• Traffic intended for legitimate servers is misrouted to the hijacker's network.
• Attackers can eavesdrop, alter traffic, or issue forged TLS certificates via HTTP domain validation.

Prevention Mechanisms

• RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
• BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.

BGP Diagnostic Tools on Teksolvr

Troubleshoot BGP routes and ASN mappings using Teksolvr's diagnostic utilities:

• Look up ASNs, IP blocks, and peering metadata with our BGP / ASN Lookup.
• Inspect global connectivity with the Ping & Traceroute Tool.
• Analyze global IP ranges using the IP Address Lookup.

BGP Configuration Example

bashCopy
router bgp 65001
 bgp router-id 10.0.0.1
 bgp log-neighbor-changes
 neighbor 10.0.0.2 remote-as 65002
 neighbor 10.0.0.2 update-source Loopback0
 neighbor 10.0.0.2 next-hop-unchanged
 neighbor 10.0.0.2 route-map rm-in out
 neighbor 10.0.0.2 route-map rm-out in
 neighbor 10.0.0.2 timers 15 30
 neighbor 10.0.0.2 timers connect 30
 neighbor 10.0.0.2 timers refresh 60
 neighbor 10.0.0.2 timers keepalive 30
 neighbor 10.0.0.2 timers uptime 0
 neighbor 10.0.0.2 timers validation 0
 neighbor 10.0.0.2 timers refresh-dampening 60
 neighbor 10.0.0.2 timers refresh-dampening-half 30
 neighbor 10.0.0.2 timers refresh-dampening-full 60
 neighbor 10.0.0.2 timers refresh-dampening-suppress 30
 neighbor 10.0.0.2 timers refresh-dampening-half-suppress 15
 neighbor 10.0.0.2 timers refresh-dampening-full-suppress 30
 neighbor 10.0.0.2 timers refresh-dampening-suppress-half 15
 neighbor 10.0.0.2 timers refresh-dampening-suppress-full 30
 neighbor 10.0.0.2 timers refresh-dampening-suppress-half-full 15
 neighbor 10.0.0.2 timers refresh-dampening-suppress-full-full 30
 neighbor 10.0.0.2 timers refresh-dampening-suppress-half-full-suppress 15
 neighbor 10.0.0.2 timers refresh-dampening-suppress-full-full-suppress 30
 neighbor 10.0.0.2 timers refresh-dampening-suppress-half-full-suppress-half 15
 neighbor 10.0.0.2 timers refresh-dampening-suppress-full-full-suppress-full 30
 neighbor 10.0.0.2 timers refresh-dampening-suppress-half-full-suppress-full-suppress 15
 neighbor 10.0.0.2 timers refresh-dampening-suppress-full-full-suppress-full-suppress 30
!

BGP Route Hijacking Detection

• RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
• BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.

BGP Route Hijacking Prevention

• RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
• BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.

BGP Route Hijacking Detection Tools

• RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
• BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.

BGP Route Hijacking Prevention Tools

• RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
• BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.

Comparison of BGP Diagnostic Tools

BGP Route Hijacking Prevention Checklist

1. RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
2. BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.
3. AS-Path validation: Verify the AS-Path of incoming BGP routes.
4. Origin validation: Verify the origin of incoming BGP routes.
5. Route filtering: Filter incoming BGP routes based on AS-Path, origin, and other attributes.
6. Route reflection: Use route reflection to reduce the number of BGP routes and improve convergence.
7. BGP confederations: Use BGP confederations to reduce the number of BGP routes and improve convergence.
8. BGP communities: Use BGP communities to filter and manipulate BGP routes.
9. BGP route dampening: Use BGP route dampening to reduce the impact of route flapping.
10. BGP route filtering: Use BGP route filtering to filter incoming BGP routes based on AS-Path, origin, and other attributes.

BGP Route Hijacking Detection Checklist

1. RPKI (Resource Public Key Infrastructure): Route Origin Authorizations (ROAs) cryptographically link IP blocks to authorized ASNs.
2. BGP Sec: Standardized extension providing cryptographic verification of the entire AS-Path.
3. AS-Path validation: Verify the AS-Path of incoming BGP routes.
4. Origin validation: Verify the origin of incoming BGP routes.
5. Route filtering: Filter incoming BGP routes based on AS-Path, origin, and other attributes.
6. Route reflection: Use route reflection to reduce the number of BGP routes and improve convergence.
7. BGP confederations: Use BGP confederations to reduce the number of BGP routes and improve convergence.
8. BGP communities: Use BGP communities to filter and manipulate BGP routes.
9. BGP route dampening: Use BGP route dampening to reduce the impact of route flapping.
10. BGP route filtering: Use BGP route filtering to filter incoming BGP routes based on AS-Path, origin, and other attributes.

BGP Route Hijacking Prevention FAQs

1. Q: What is BGP route hijacking? A: BGP route hijacking occurs when an unauthorized Autonomous System announces IP prefixes in BGP that it does not own.
2. Q: How can I prevent BGP route hijacking? A: You can prevent BGP route hijacking by using RPKI (Resource Public Key Infrastructure) Route Origin Authorizations (ROAs) and BGP Sec.
3. Q: What is RPKI (Resource Public Key Infrastructure)? A: RPKI (Resource Public Key Infrastructure) is a system for cryptographically linking IP blocks to authorized ASNs.
4. Q: What is BGP Sec? A: BGP Sec is a standardized extension providing cryptographic verification of the entire AS-Path.
5. Q: How can I detect BGP route hijacking? A: You can detect BGP route hijacking by using RPKI (Resource Public Key Infrastructure) Route Origin Authorizations (ROAs) and BGP Sec.

BGP Route Hijacking Detection FAQs

1. Q: What is BGP route hijacking? A: BGP route hijacking occurs when an unauthorized Autonomous System announces IP prefixes in BGP that it does not own.
2. Q: How can I detect BGP route hijacking? A: You can detect BGP route hijacking by using RPKI (Resource Public Key Infrastructure) Route Origin Authorizations (ROAs) and BGP Sec.
3. Q: What is RPKI (Resource Public Key Infrastructure)? A: RPKI (Resource Public Key Infrastructure) is a system for cryptographically linking IP blocks to authorized ASNs.
4. Q: What is BGP Sec? A: BGP Sec is a standardized extension providing cryptographic verification of the entire AS-Path.
5. Q: How can I prevent BGP route hijacking? A: You can prevent BGP route hijacking by using RPKI (Resource Public Key Infrastructure) Route Origin Authorizations (ROAs) and BGP Sec.

References

• RFC 4271: A Border Gateway Protocol 4 (BGP-4)
• RFC 6811: BGP-SEC: BGP Extensions for BGP-SEC
• RFC 8205: BGP-SEC: BGP Extensions for BGP-SEC
• RFC 8952: BGP-SEC: BGP Extensions for BGP-SEC

Diagram

Flowchart

Troubleshooting Checklist

1. Verify BGP configuration: Verify that the BGP configuration is correct and that the router is properly configured.
2. Verify AS-Path: Verify that the AS-Path of incoming BGP routes is correct.
3. Verify origin: Verify that the origin of incoming BGP routes is correct.
4. Verify route filtering: Verify that the route filtering is correct and that the router is properly configured.
5. Verify route reflection: Verify that the route reflection is correct and that the router is properly configured.
6. Verify BGP confederations: Verify that the BGP confederations are correct and that the router is properly configured.
7. Verify BGP communities: Verify that the BGP communities are correct and that the router is properly configured.
8. Verify BGP route dampening: Verify that the BGP route dampening is correct and that the router is properly configured.
9. Verify BGP route filtering: Verify that the BGP route filtering is correct and that the router is properly configured.
10. Verify BGP configuration: Verify that the BGP configuration is correct and that the router is properly configured.

FAQs

1. Q: What is BGP route hijacking? A: BGP route hijacking occurs when an unauthorized Autonomous System announces IP prefixes in BGP that it does not own.
2. Q: How can I prevent BGP route hijacking? A: You can prevent BGP route hijacking by using RPK