BGP for Sysadmins

Introduction¶

You probably won't run BGP, but you'll hit it — a provider outage caused by a route leak, a "our IPs are blackholed" incident, or a looking-glass output in a postmortem. This is the working knowledge to make sense of those.

Concepts¶

The internet is ~75,000 Autonomous Systems (AS) — networks under one administration, each with an AS number. BGP is how ASes tell each other "to reach these IP prefixes, send traffic through me."

A BGP route is a prefix (93.184.216.0/24) plus attributes, the most important being the AS_PATH — the list of ASes the announcement traversed. Shorter paths are generally preferred, and the AS_PATH also prevents loops (an AS rejects a route that already contains its own number).

eBGP vs iBGP¶

• eBGP — between different ASes (you and your transit provider). This is where the internet's routing table is exchanged.
• iBGP — within one AS, to distribute externally-learned routes to all your routers. iBGP has a full-mesh requirement (or route reflectors) and doesn't prepend the AS number.

Path selection (simplified)¶

BGP picks one best path per prefix, in this order (first tiebreaker wins):

1. Highest weight (Cisco-local) / local-preference (AS-wide policy — "prefer this provider")
2. Shortest AS_PATH
3. Lowest origin type, lowest MED
4. eBGP over iBGP
5. Lowest IGP metric to the next hop
6. Oldest route / lowest router ID (stability tiebreakers)

Operators mostly steer traffic with local-preference (inbound provider choice) and AS_PATH prepending (making a path look longer to discourage inbound traffic on it).

Reading a looking glass¶

Public looking glasses (bgp.he.net, RIPE RIS, your provider's) show how the world sees a prefix:

Prefix: 93.184.216.0/24
AS_PATH: 174 3356 15133
Origin AS: 15133 (the network that owns the IPs)

bgp.tools and whois -h whois.radb.net give ownership and route-object data.

Incidents you'll see¶

• Route leak — an AS re-announces routes it learned from one provider to another provider, becoming an unintended transit. Traffic detours through an undersized network → congestion, latency, partial outage. Mitigated by filtering and RFC 8212 (default-deny eBGP).
• BGP hijack — an AS announces a prefix it doesn't own, pulling traffic to itself (accidental or malicious). The 2008 YouTube/Pakistan incident is the classic; the 2018 Amazon Route 53 hijack was used to steal cryptocurrency.
• Flapping — a link goes up/down repeatedly, re-announcing and withdrawing routes. Route flap damping suppresses an unstable prefix for a while.

RPKI¶

Route Origin Authorization (ROA) — a cryptographically signed statement: "AS 15133 is authorised to originate 93.184.216.0/24." Routers doing ROV (Route Origin Validation) drop announcements that conflict (invalid). This stops the most common origin hijacks; it does not stop path manipulation (that's ASPA / BGPsec, still rolling out).

# Is a prefix covered by a valid ROA?
# https://rpki-validator.ripe.net  or:
whois -h whois.bgpmon.net " --roa 15133 93.184.216.0/24"

Verification and troubleshooting¶

• "Our IPs are unreachable from some networks" — check a looking glass from several vantage points. If some ASes show the prefix and others don't, a route was withdrawn upstream or an RPKI invalid is filtering you (a bad or expired ROA — a very common self-inflicted outage).
• Sudden latency spike, path changed — AS_PATH in the looking glass now goes through a different transit. A provider link failed and traffic rerouted, or someone changed local-pref.
• Traffic to us takes a bad path — you're prepending too aggressively on the good link, or the remote network prefers the other provider. Adjust prepending / communities with your provider.
• New /24 not visible globally — providers filter prefixes longer than /24; a /25 won't propagate. Also allow time (minutes) and check your provider actually accepted the announcement.
• RPKI shows invalid — your ROA has the wrong origin AS or max-length, or it expired. Fix the ROA at your RIR; propagation to validators takes a few hours.

Related tools and reading¶

• On-site: IP Lookup (ASN + WHOIS), Traceroute, WHOIS.
• Related posts: OSPF areas and LSA types, How NAT actually works.