BGP
Also known as: Border Gateway Protocol, BGP4, ASN, BGP hijacking, RPKI, route leak
BGP (Border Gateway Protocol) is the protocol that makes the internet work as a network of networks.
Internet service providers, cloud providers, and large enterprises use BGP to announce which IP address ranges they own and to exchange routing information, determining the path that packets take across the globe.
BGP, explained at three levels
At home
The internet is thousands of separate networks (your ISP, AWS, Google, etc.) that need to talk to each other. BGP is how they do it: each network announces 'I own these IP addresses' and BGP routers figure out the best paths to reach any address on the internet.
At work
Large companies with their own IP address blocks use BGP to announce their addresses to the internet and to choose which ISPs carry their traffic. Multi-homed enterprises (connected to multiple ISPs) use BGP to control traffic routing for redundancy and performance.
At home
BGP routes between Autonomous Systems (AS): independently operated networks identified by an AS Number (ASN). Each AS announces IP prefixes (e.g., '203.0.113.0/24 is reachable via AS 65001'). BGP uses TCP port 179. Path selection uses AS_PATH (prefer shorter paths) and numerous other attributes. The global BGP routing table has roughly one million IPv4 prefixes.
At work
Cloud providers use BGP for global anycast: the same IP address is advertised from multiple locations worldwide, and BGP routes users to the nearest one. AWS uses BGP for Direct Connect (dedicated private connections from enterprise to AWS). BGP communities are metadata tags on routes used to signal routing policies between providers.
At home
BGP is a path-vector protocol: each route advertisement includes the complete AS path (sequence of ASNs), preventing routing loops. BGP's decision process evaluates attributes in order: local preference, AS_PATH length, MED (multi-exit discriminator), and more. IBGP (internal BGP) runs within an AS; EBGP (external BGP) runs between ASes. Route reflectors in IBGP prevent the full mesh requirement.
At work
BGP security is a known challenge. RPKI (Resource Public Key Infrastructure) cryptographically validates that an AS is authorized to announce specific prefixes, preventing BGP hijacking. ROA (Route Origin Authorization) records tie prefixes to their legitimate origin AS. Despite RPKI deployment, full adoption is incomplete, leaving the global BGP table partially vulnerable to misconfiguration and malicious hijacking. Facebook's 2021 outage resulted from BGP route withdrawal (accidentally removing their own routes) rather than hijacking.
Real-world examples
At home
Jerome's home internet doesn't use BGP directly, but BGP is why his packets reach Google. His ISP uses BGP to announce its routes to upstream providers and peers, creating the path from his home to any server on the internet.
At work
Nadia's company is multi-homed to two ISPs. They use BGP to advertise their IP ranges through both providers simultaneously. When one ISP has an outage, BGP automatically routes traffic through the other, maintaining internet access without manual intervention.
Common confusions
- BGP is only used by ISPs — Large enterprises, cloud providers, content delivery networks, and any organization with their own IP address blocks use BGP. Universities, financial institutions, and companies with global operations commonly run BGP.
- BGP is the same as DNS — DNS translates domain names to IP addresses. BGP handles routing: it determines how packets travel between networks to reach those IP addresses. Both are essential internet infrastructure but perform completely different functions.
For analysts
BGP route leaks and hijacking events cause internet outages that affect service availability: understanding BGP helps BAs frame incident post-mortems and risk assessments for businesses dependent on internet connectivity.
History & origin
BGP was developed in 1989 by Kirk Lougheed and Yakov Rekhter over lunch on the back of napkins, hence the original spec nickname 'two-napkin protocol'. BGP-4, first published in 1994 and now defined in RFC 4271 (2006), added CIDR (Classless Inter-Domain Routing) support. BGP is sometimes called 'the protocol that holds the internet together': it's the only exterior routing protocol used between autonomous systems (ASes) at internet scale. BGP mistakes, from route leaks to bad configuration changes, have caused major outages, including Facebook's 2021 global outage.