The global internet functions through tens of thousands of separate networks instead of a single unified grid. Understanding how BGP routing works reveals how these separate networks, called autonomous systems, share reachability data and direct traffic over reliable paths without central oversight. Border Gateway Protocol serves as the postal service and map maker of the internet by collecting route announcements from internet service providers, university backbones, and cloud hosting platforms. Every border router analyzes path updates to select dependable trajectories and quietly reroutes traffic whenever fiber connections break [7].
What Autonomous Systems Share
Tens of thousands of independent networks compose the internet landscape. Each network operates under a single network team and relies on a unique autonomous system number, or ASN, to identify its borders to surrounding peers. Telecom carriers, university networks, and cloud providers all manage these numbered domains [7].
Instead of passing payload packets during path discovery, border routers exchange network layer reachability information to outline valid address blocks. Border gateways announce the IP prefix ranges they can deliver to neighbors, specifying every intermediate transit domain a packet must cross to reach destination servers without entering routing loops. Neighboring routers accept prefix lists to build local forwarding tables. Standard exterior gateways guide traffic hop-by-hop between public autonomous systems, but specialized privacy systems route packets through separate multi-hop tunnels, as detailed in Tor network routing and encrypted relays.
Routers maintain firm borders between interior networks and exterior reachability, building upon earlier experience with EGP defined in RFC 904 and deployed in the NSFNET Backbone under RFC 1092 and RFC 1093 [1]. Yakov Rekhter from the T.J. Watson Research Center at IBM Corp. and Kirk Lougheed from Cisco Systems designed the protocol at the twelfth IETF meeting in Austin, Texas, in January 1989. Rekhter and Lougheed collaborated with Len Bosack to sketch the Two-Napkin Protocol before expanding their concepts onto three handwritten pages. The sheets hang at Cisco Systems in Milpitas, California [6]. The notes produced RFC 1105 for NSFNET Nodal Switching Systems, followed by RFC 1136, RFC 1163, and RFC 1164 [1].
Why BGP Routing Works as a Path Vector System
Most local routing algorithms compute distances using link costs or hop counts. Learning how BGP routing works in practice shows that it operates as a path vector protocol, storing the complete sequence of autonomous systems traversed by each reachability update. Border gateways evaluate path validity before accepting routing records [6].
The AS_PATH attribute lists every network an advertisement has crossed in reverse chronological order. When a gateway receives an update from an external peer, it scans this sequence to verify that its own autonomous system number does not appear in the record [3]. If the local number is present, the gateway drops the update immediately. Scanning path sequences prevents packets from circulating endlessly between competing internet service providers that share transit agreements. Loop prevention is the cornerstone of inter-domain stability [6].
Unlike link-state protocols that demand identical topological databases on every device, a path vector protocol relies on hop-by-hop forwarding where an autonomous system advertises to neighbors only the routes that it uses for its own traffic. Guy Almes from Rice University chaired the Interconnectivity Working Group, helping Kirk Lougheed and Yakov Rekhter prepare RFC 1267 in October 1991. Contributors included Jeffrey C. Honig from the Cornell Theory Center, Bob Braden from ISI, and Bob Hinden from the Internet Engineering Steering Group. Their specification confirmed that path vectors let network operators enforce business routing rules without revealing interior network topology to rival carriers [2].
Six States of the Peering Connection
Routers establish peering connections over TCP port 179. By running on top of a reliable transport protocol, BGP completely eliminates the need to implement custom packet sequencing, retransmissions, checksum verification, or complex update fragmentation. Peers execute a finite-state machine with six defined stages to set up and manage connections [6].
The session begins in the Idle state, where the router allocates memory resources, refuses incoming connection attempts, and prepares to initiate a TCP handshake. It then transitions to Connect, waiting for the transport session to complete. If the initial handshake fails, the router enters the Active state, resets the ConnectRetry timer, and attempts another transport connection [6]. Incorrect peer IP addresses, mismatched autonomous system numbers, or blocked firewall ports often trap routers in a loop between Idle and Active states.
Once the TCP handshake finishes, the router enters OpenSent and transmits an Open message containing its version number, autonomous system number, hold time value, and BGP identifier. If the parameters match, the remote peer responds with a keepalive message, prompting the router to transition to OpenConfirm. After confirming connection parameters, the session enters Established. In Established state, peers send full routing tables followed by incremental Update messages when network topology shifts. Routers exchange 19-byte keepalive messages every 30 seconds to confirm connection liveness. If the hold timer expires without receiving an update, the router closes the connection [6].
How BGP Routing Works to Select the Best Path
When a border router learns multiple paths toward the same IP destination, it runs the BGP best path algorithm to select a single route for packet forwarding. Explaining how BGP routing works during best-path selection reveals how network devices systematically evaluate route attributes to filter competing candidates until one winning path remains [3]. Cisco routers execute this comparison whenever new update messages arrive.
The decision tree evaluates attributes in an exact order. Cisco routers first prefer paths with the highest WEIGHT, a proprietary local value, followed by the highest LOCAL_PREF configured within the autonomous system. If values match, the algorithm prefers locally originated routes over learned paths, followed by paths with the shortest AS_PATH length. Origin type serves as the next tiebreaker, favoring routes learned from interior protocols over exterior protocols. Routers then evaluate the lowest multi-exit discriminator, prefer eBGP paths over iBGP paths, and check the lowest interior metric to the next hop [3].
If candidate paths remain tied after evaluating distance metrics, the algorithm evaluates connection age and router identity. When competing routes arrive from exterior peers, the router prefers the oldest path to minimize route flap caused by unstable links. If that test fails to break the tie, the router selects the route arriving from the peer with the lowest router ID, which is derived from the highest loopback IP address or set manually. As documented by Cisco engineers vbaveja and sshamim for network prefix 10.30.116.0/23, path 6 won among 9 candidate entries because its sending router had a lower router ID than path 5 [3].
Why Is BGP Preferred Over OSPF?
Enterprise networks often use OSPF to coordinate local routers, yet OSPF cannot scale to handle the global internet. OSPF forces every router within an area to maintain an identical topological database of every link and subnet, calculating shortest paths with Dijkstra’s algorithm. Link calculation overhead becomes prohibitive when connecting millions of disparate endpoints in different organizational domains [6].
Scale differences explain why network engineers choose Border Gateway Protocol for inter-domain connections. Network engineers studying how BGP routing works compare its exterior reachability to interior protocols like OSPF, recognizing that BGP tracks reachable autonomous systems instead of calculating shortest wire links. While interior protocols flood entire network areas with link-state advertisements during minor link state changes, BGP sends incremental updates only for affected prefixes [6]. Selective updates conserve memory and CPU processing between thousands of independent border routers.
Commercial policy enforcement offers another clear reason BGP dominates exterior routing. Interior protocols like OSPF route traffic purely on technical metrics such as bandwidth and transit delay, offering no native way to enforce business agreements between competing carriers [6]. BGP allows network administrators to use route-maps to filter prefixes, adjust local preferences, and drop traffic from specific upstream providers based on settlement contracts. Alotaibi, Gregory, and Li showed that while software-defined networking improves convergence delay in multidomain environments, BGP-4 is indispensable because it delivers policy autonomy over autonomous system boundaries [8].
Community Attributes for Policy Control
Network administrators tag route advertisements with BGP communities to control how neighboring peers handle incoming traffic. Defined in RFC 1997, a standard community is a numerical attribute added to an update to signal policy actions through transit networks. Operators use these values to trigger automated routing decisions without modifying core path attributes [4].
The community value space ranges from 0x00000000 to 0xFFFFFFFF, with private use allocated between 0x00010000 and 0xFFFEFFFF. Well-known communities carry standardized meanings among all conforming routers. For instance, the NO_EXPORT community (0xFFFFFF01) instructs a receiving peer not to advertise the route outside its local autonomous system, while NO_ADVERTISE (0xFFFFFF02) blocks advertisement to any peer. RFC 7999 defines the BLACKHOLE community (0xFFFF029A), which signals upstream providers to drop malicious traffic directed at target subnets during volumetric denial-of-service attacks [4].
Modern traffic steering often uses extended communities defined in RFC 7153 and RFC 9184 to support complex multi-domain services. The 8-octet attributes include route targets for BGP Virtual Private Networks and flow specification rules for automated filtering [5]. Edge networks often manage traffic entry points using proxy architectures, comparable to Cloudflare OHTTP gateway deployments designed to decouple client network addresses from destination services. RFC 8326 introduced GRACEFUL_SHUTDOWN (0xFFFF0000) to let operators drain traffic gracefully before planned maintenance, reducing packet loss along transit links [4].
Operational Limits of the 512k Day
Border routers store internet routes in memory structures called the Routing Information Base. Software processes maintain master routing tables alongside adjacent incoming and outgoing tables for each connected peer, translating path announcements into forwarding records [6]. High-speed memory on forwarding hardware maintains fixed capacity limits that cannot expand without replacement equipment [7].
On August 12, 2014, the global routing table reached a capacity threshold known across the networking industry as the 512k day. Older enterprise and service provider routers had hardware chips set up to hold around 512,000 routing entries. When the total number of advertised global routes crossed 512,000, those older routers ran out of memory, causing packet loss and routing instability in several regions. The event proved that inter-domain routing scalability depends on hardware memory limits [7].
Route table growth continues as organizations advertise more specific prefix blocks. In October 2021, an automated configuration change withdrew all BGP routes for Facebook, Instagram, and WhatsApp, disconnecting their data centers from the internet for six hours [7]. Servers stayed powered, but recursive DNS resolvers could not locate them because the BGP road signs had vanished. To analyze such scaling issues, research by Weitz and colleagues evaluated router policies using the Bagpipe verification system, which checked over 240,000 lines of configuration within three autonomous systems to prevent route leaks before deployment [9].
Handling Prefix Hijacking in BGP Routing
Standard BGP implementations rely on trust between neighboring peers. Routers generally assume that incoming route advertisements accurately reflect the legitimate ownership of announced IP address spaces without demanding cryptographic proof. Examining how BGP routing works under adversarial conditions exposes weaknesses that malicious actors or careless administrators exploit through prefix hijacking [10].
In a prefix hijack, an unauthorized autonomous system advertises an IP prefix that belongs to another entity. Because BGP routers automatically prefer more specific subnets or shorter AS paths, traffic destined for legitimate services gets redirected to the rogue autonomous system. Hijacks cause widespread service outages or enable eavesdropping on unencrypted traffic flows. Mastilak and colleagues observed that centralized public key infrastructures face slow global adoption, prompting researchers to explore decentralized ledgers to validate BGP updates [10].
Detecting anomalies for inter-domain routes requires specialized monitoring frameworks. Papadopoulos and coauthors introduced BGPGraph, an analytics scheme that quantifies activity deviations to visualize prefix hijacking and route leaks over time windows [11]. Furthermore, a systematic survey by Scott, Johnstone, and Szewczyk evaluated 178 attack detection techniques, showing that current defenses must analyze multi-viewpoint telemetry instead of relying on single monitoring points. Until cryptographic route origin validation becomes ubiquitous among all tier-one carriers, BGP routing is vulnerable to human error and deliberate path manipulation [13].
- REPORT Lougheed, K., & Rekhter, Y. (1989). Border Gateway Protocol (BGP). RFC 1105. [Article Link]
- REPORT Lougheed, K., & Rekhter, Y. (1991). Border Gateway Protocol 3 (BGP-3). RFC 1267. [Article Link]
- WEBSITE Cisco. (2026). Select BGP Best-Path Algorithm. [Article Link]
- WEBSITE Internet Assigned Numbers Authority. (2026). Border Gateway Protocol (BGP) Well-known Communities. [Article Link]
- WEBSITE Internet Assigned Numbers Authority. (2026). Border Gateway Protocol (BGP) Extended Communities. [Article Link]
- WEBSITE Wikipedia. (2026). Border Gateway Protocol. [Article Link]
- ONLINE NEWS Orbit Computer Solutions. (2026). So what is BGP? Border Gateway Protocol Explained. [Article Link]
- ACADEMIC JOURNAL Alotaibi, H. S., Gregory, M. A., & Li, S. (2022). Multidomain SDN-Based Gateways and Border Gateway Protocol. Journal of Computer Networks and Communications, 2022, 1-23. [Article Link]
- ACADEMIC JOURNAL Weitz, K., Woos, D., Torlak, E., Ernst, M. D., Krishnamurthy, A., & Tatlock, Z. (2016). Scalable verification of border gateway protocol configurations with an SMT solver. ACM SIGPLAN Notices, 51(10), 765-780. [Article Link]
- ACADEMIC JOURNAL Mastilak, L., Galinski, M., Helebrandt, P., Kotuliak, I., & Ries, M. (2020). Enhancing Border Gateway Protocol Security Using Public Blockchain. Sensors, 20(16), 4482. [Article Link]
- ACADEMIC JOURNAL Papadopoulos, S., Moustakas, K., Drosou, A., & Tzovaras, D. K. (2015). Border gateway protocol graph: detecting and visualising internet routing anomalies. IET Information Security, 10(3), 125-133. [Article Link]
- ACADEMIC JOURNAL Zhao, X., Band, S. S., Elnaffar, S., Sookhak, M., Mosavi, A. H., & Salwana, E. (2021). The Implementation of Border Gateway Protocol Using Software-Defined Networks: A Systematic Literature Review. IEEE Access, 9, 112596-112606. [Article Link]
- ACADEMIC JOURNAL Scott, B. A., Johnstone, M. N., & Szewczyk, P. (2024). A Survey of Advanced Border Gateway Protocol Attack Detection Techniques. Sensors, 24(19), 6414. [Article Link]
