Border Gateway Protocol (BGP) Definition

What is the Border Gateway Protocol (BGP)?

The Internet isn’t one, huge, homogeneous network. It’s actually composed of several smaller networks that are operated by various parties and connected together. For example, Internet Service Providers (ISPs) each have their own network infrastructures, and these networks are connected to one or more other ISPs’ networks in certain ways.

When a network packet is traversing the Internet, it likely will need to find a route that crosses one or more of these independent networks, which are called Autonomous Systems (ASes). The Border Gateway Protocol (BGP) is a network protocol designed to help packets find a route between these ASes to their destinations.

How Does BGP Work?

The role of BGP is to find routes for traffic across AS boundaries. Within an AS, the owner of the network is responsible for routing the traffic to its intended destination.

BGP enables ASes to build up routing tables by collaborating with other ASes. Each AS will identify the routing prefixes (ranges of IP addresses) that are located in their own networks. They’ll share this information with the ASes adjacent to them, and the information will percolate through the system.

When receiving these values, it’s likely that there will be overlapping information. For example, if AS A is connected to B and C and B and C are connected, then A could route traffic to C directly or by way of B. In general, ASes will choose the best path based on a few different features.

With a routing table in place, an AS will be able to route traffic to any IP address on the Internet by sending it to the next AS on the optimal route. These routing tables are also periodically updated to reflect changes in the overall layout of the Internet.

What are BGP Hijacking Attacks?

Like many core network protocols, BGP operates on the honor system. If a AS reports that it has an efficient route to a particular destination, other ASes will trust that route and update their routing tables accordingly. As long as the packet reaches its destination, there is no reason to disbelieve an AS’s route advertisement.

However, this reliance on trust creates opportunities for a malicious AS to hijack the system. For example, an AS might advertise a fake, efficient route to a range of IP addresses. After this route has been advertised to other ASes, they would likely update their routing tables to include the new route, replacing whatever routes they had in place for that IP range.

When these ASes receive a packet for that range of IP addresses, they would use the new, efficient route. This would cause all traffic to that range of IP prefixes to be sent through the malicious AS’s systems, allowing them to filter that traffic or extract any information that they can from it. Afterwards, they can send the traffic to its intended destination by placing it on the route that it should have taken.

These BGP hijacking attacks have occurred both intentionally and accidentally. These incidents led to disruption in Internet traffic or outages of certain services. For example, an attempt in 2008 by the Pakistan Telecommunications Company to block YouTube caused the service to be globally unavailable for some time after the AS accidentally advertised fake routes for YouTube IP addresses (designed to make the service unavailable locally) to other ASes.

Conclusion

BGP is a core Internet protocol designed to stitch the various AS networks into a single, connected Internet. While the system works, it is also fragile and vulnerable to intentional or unintentional disruption.