Widespread BGP ORIGIN Attribute Manipulation Undermines Internet Routing Stability
Cloudflare research reveals approximately 70% of observed Border Gateway Protocol (BGP) paths have a manipulated ORIGIN attribute, impacting traffic routing and provider revenue.
The fundamental routing protocol of the internet, Border Gateway Protocol (BGP), relies on path attributes to guide traffic flow. Among these, the ORIGIN attribute, intended to signify how a route was injected into BGP, is frequently manipulated by transit providers. Cloudflare's recent investigation uncovered that a staggering 70% of observed BGP paths exhibit a modified ORIGIN attribute, deviating from its intended purpose and significantly influencing how internet traffic is directed.
The ORIGIN attribute has three possible values: IGP (Interior Gateway Protocol), indicating a route originated within the Autonomous System (AS); EGP (Exterior Gateway Protocol), a historical and largely obsolete value; and INCOMPLETE, signifying a route learned from an unknown or external source. While IGP is the most common value, representing nearly 90% of observed routes, the presence of EGP and INCOMPLETE routes, though smaller in percentage, can still play a role in BGP path selection. According to BGP standards, the ORIGIN attribute should not be altered by routers after its initial injection by the originating AS.
However, the BGP path selection algorithm evaluates the ORIGIN attribute early in its process. If two routes have equal Local Preference and AS_PATH length, the path with the lower ORIGIN value is preferred. This characteristic makes the ORIGIN attribute an attractive target for ASes aiming to influence traffic flow. By changing an ORIGIN value to IGP, even if inaccurate, a transit provider can make its routes appear more favorable, thereby attracting more traffic and, consequently, more revenue.
This practice, while not new, has become a silent norm within the network operator community. Major networks have been observed rewriting the ORIGIN attribute to IGP to gain a competitive edge. This widespread manipulation has led to a situation where network operators feel compelled to adopt similar tactics simply to maintain parity with their competitors, rather than adhering strictly to BGP standards. An expired Internet-Draft even proposed the deprecation of the ORIGIN attribute due to these inconsistencies.
To quantify the extent of this phenomenon, Cloudflare conducted an experiment. They announced BGP prefixes with different ORIGIN values (IGP, EGP, INCOMPLETE) from their global peering locations. By analyzing BGP Update messages from various public collectors and their own network data, they aimed to identify how frequently these attributes were being altered in transit. The analysis focused on Update messages rather than RIB dumps to capture a broader range of routes during both announcement and withdrawal phases.
The findings indicate a significant deviation from the intended use of the ORIGIN attribute, with approximately 70% of observed paths showing manipulation. This widespread alteration has direct implications for network performance, traffic engineering, and the overall stability of internet routing. The practice highlights a tension between adherence to protocol standards and the commercial pressures faced by internet service providers.
While the research provides concrete data on the prevalence of ORIGIN attribute manipulation, it also underscores the challenges in enforcing BGP standards across the diverse landscape of the internet. The lack of universal visibility into all ASes and the complex interplay of commercial interests make it difficult to curb such practices. The study serves as a critical examination of a fundamental aspect of internet infrastructure that is being exploited for commercial gain.
This ongoing manipulation of BGP routing information raises concerns about the predictability and reliability of internet traffic. As more entities engage in these practices to optimize their own traffic flow and revenue, the integrity of the global routing system is put at risk. The research by Cloudflare provides valuable insights into this complex issue, urging a broader discussion on BGP security and the need for greater standardization and enforcement.