Understanding BGP ORIGIN Attribute Manipulation and its Impact on Internet Routing
This article explores the manipulation of the BGP ORIGIN attribute by Autonomous Systems (ASes) and its significant impact on Internet traffic forwarding. It details how modifying this attribute, contrary to RFC guidelines, can influence path selection and divert traffic, primarily for economic gain. Cloudflare's experiments reveal a widespread adoption of this practice, especially among large Tier-1 networks, highlighting a critical architectural challenge in global routing.
Read original on Cloudflare BlogThe Border Gateway Protocol (BGP) is fundamental to how the Internet routes traffic between Autonomous Systems (ASes). BGP relies on path attributes to carry essential routing information. One critical, yet often manipulated, attribute is ORIGIN, which indicates how a route was injected into BGP.
The BGP ORIGIN Attribute
The ORIGIN attribute has three values: IGP (route is internal to originating AS), EGP (obsolete), and INCOMPLETE (route from an unknown/external source). According to RFC4271, this attribute should not be changed after being set by the originating speaker. However, the article demonstrates widespread manipulation.
- IGP (0): Interior Gateway Protocol. The route originated within the AS.
- EGP (1): Exterior Gateway Protocol. An outdated value, rarely used.
- INCOMPLETE (2): Route learned via an unknown or external source.
Impact on Path Selection
The ORIGIN attribute is evaluated early in the BGP path selection process, after Local Preference and AS_PATH length. A lower ORIGIN value (IGP < EGP < INCOMPLETE) is preferred. This preference incentivizes ASes to rewrite INCOMPLETE or EGP to IGP to attract more traffic, effectively *siphoning* traffic and revenue. Cloudflare's experiments found that approximately 70% of observed paths had a manipulated ORIGIN value.
Architectural Implication
This manipulation highlights a significant challenge in the trust and decentralized nature of Internet routing. While BGP is designed to be self-governing, economic incentives can lead to deviations from protocol specifications, impacting global traffic patterns and potentially leading to suboptimal routing or congestion.
Detecting and Quantifying Manipulation
Cloudflare conducted experiments by announcing prefixes with different ORIGIN values and monitoring BGP Update messages globally. They identified that a substantial percentage of direct peers (nearly 10%) and even major Tier-1 networks (26% of top 50 ASes) manipulate the ORIGIN attribute to IGP, especially for IPv4 traffic. This manipulation results in a significant increase in paths traversing the networks of ORIGIN rewriters, diverting traffic away from networks that preserve the original ORIGIN.