BGP

Each AS adds its own number to AS_PATH when advertising a route to an external peer. A BGP speaker that finds its own AS number in a received AS_PATH treats the route as a loop and does not use it.

BGP runs over TCP port 179 so TCP supplies retransmission, ordering and sequencing for it. A BGP-4 session uses four messages: OPEN starts it, UPDATE advertises and withdraws routes, NOTIFICATION reports an error and closes it, KEEPALIVE shows the peer is alive.

eBGP joins speakers in different autonomous systems, iBGP speakers in the same one. eBGP prepends the sender's AS number and normally rewrites NEXT_HOP; iBGP changes neither and, outside route reflection, does not relay one iBGP peer's routes to another.

A stub AS has one neighbouring AS; a multihomed AS has several but, as an enterprise, carries only its own traffic; a transit AS carries traffic between other ASes. An enterprise mainly needs its own ASN to multihome.

Unusable paths go first (unresolvable NEXT_HOP, own AS in AS_PATH). Then: highest LOCAL_PREF, shortest AS_PATH, lowest ORIGIN, lowest MED from one neighbouring AS, eBGP over iBGP, lowest IGP cost to NEXT_HOP, lowest BGP Identifier, lowest peer address.

Well-known mandatory attributes (ORIGIN, AS_PATH, NEXT_HOP) are understood by every speaker and carried on every route; well-known discretionary ones (LOCAL_PREF, ATOMIC_AGGREGATE) are understood but sent only when relevant; unrecognised optional transitive ones are passed on, unrecognised non-transitive ones dropped.

A BGP import policy decides which routes from a neighbour are eligible, with what attributes; an export policy decides which selected routes are announced to it. RFC 8212 makes an eBGP session without explicit policy accept and announce nothing.

A prefix hijack announces address space, or a path to it, that the announcer has no right to claim; a route leak passes a genuine route beyond its intended scope. Base BGP verifies neither, so neighbours believe both.

A BGP session goes Idle, Connect (TCP attempt), OpenSent (TCP up, OPEN sent), OpenConfirm (peer's OPEN accepted, KEEPALIVE sent) and Established (peer's KEEPALIVE received). Active means it is waiting for a TCP connection; most errors return it to Idle.

In BGP, Active means the speaker has no TCP connection to its peer yet: it listens, and redials when ConnectRetryTimer expires. Stuck there means TCP never completes: no route, wrong peer or source address, port 179 filtered, or mismatched authentication.

Inside one AS the AS_PATH is never changed, so BGP's loop check cannot catch a route circulating between internal peers. RFC 4271 therefore forbids relaying iBGP-learned routes to iBGP peers, so in base BGP every speaker must peer with every other one: n(n-1)/2 sessions.

Outbound traffic follows your own routers' decision, where LOCAL_PREF is compared first. Inbound traffic follows other ASes' decisions: MED and a longer AS_PATH are hints they weigh only after their own LOCAL_PREF, and MED only among routes from your AS.

Accept only the customer's verified /22 and its agreed more-specifics down to /24, on AS paths made solely of the customer's ASN; reject everything else, drop RPKI-invalid routes, and cap the session with a maximum-prefix limit.

Origin validation proves only that a route's origin AS, the rightmost AS in its path, is authorized by a ROA to originate that prefix at that length. Nothing checks the rest of the path, so a hijacker who appends the real origin passes.

BGP's decision is policy first: a route's degree of preference, carried as LOCAL_PREF inside an AS, is compared before AS_PATH length. And AS_PATH length counts networks, not routers, bandwidth or delay, so it is only a rough tie-breaker.

RFC 6793 widens AS numbers from 16 to 32 bits, negotiated by a BGP capability. Toward a speaker without it, any ASN above 65535 becomes AS_TRANS (23456) in 2-byte fields, and the true path rides in the optional transitive AS4_PATH.

RFC 6996 reserves 64512-65534 and 4200000000-4294967294 for private use. Because they are not globally unique, private ASNs must be removed from AS_PATH, and AS4_PATH, before routes are advertised to the global Internet.

At each eBGP border AS_PATH gains the sender's AS and NEXT_HOP is normally rewritten; LOCAL_PREF never crosses and is set afresh inside each AS; a received MED stops at the next AS; ORIGIN stays; COMMUNITIES pass unless policy edits them.

COMMUNITIES is an optional transitive attribute holding a set of 32-bit tags whose meaning operators agree on. A route tagged NO_EXPORT must not be advertised outside the receiving AS or confederation; one tagged NO_ADVERTISE must not be advertised to any peer.

A BGP prefix list matches the prefix and its length range, an AS-path filter matches the AS_PATH with a regular expression, and a route map is an ordered list of match-and-set clauses that combines them into a session's policy.

Each BGP peer proposes a hold time in its OPEN and both use the smaller, which must be zero or at least 3 seconds. KEEPALIVEs flow about every third of it; if nothing arrives in time, the session closes with Hold Timer Expired.

iBGP leaves NEXT_HOP pointing at the external neighbour, so an interior router without an IGP route to that address must exclude the route from selection. Fix it at the border with next-hop-self, or by carrying the external link's subnet in the IGP.

It announced routes learned from one ISP to the other, so the second ISP, often preferring customer routes, sent traffic for the first ISP's destinations through it. Its links fill with others' traffic; RFC 7908 calls this a route leak.

If both NEXT_HOPs resolve and LOCAL_PREF is equal, the iBGP path wins on the shorter AS_PATH, two ASes against three, before eBGP-over-iBGP is reached. An unresolvable iBGP NEXT_HOP or a higher LOCAL_PREF on the eBGP path reverses that.

RFC 4271 installs one path; multipath is an implementation extension. Paths qualify when they tie through interior cost to the NEXT_HOP — same LOCAL_PREF, AS_PATH length, ORIGIN, MED, session type and IGP cost — usually from the same neighbouring AS.

Each eBGP session's import policy tags routes with a community recording the relationship they came from; export policy toward peers and upstreams permits only customer-tagged and own routes, and inbound scrubbing stops neighbours forging those tags.

Prepending lengthens the AS_PATH on the less-wanted link and only nudges remote choices, since their LOCAL_PREF comes first; a more-specific on the wanted link wins by longest-prefix match but grows the global table and needs the aggregate kept as fallback.

An exact-prefix hijack competes with the real route in each AS's best-path decision, so the Internet splits between them. A more-specific is a different prefix with no rival, and longest-prefix match forwards to it wherever it is accepted.

A valley-free path climbs customer-to-provider links, crosses at most one peer link, then only descends: routes from a provider or peer go only to customers. BGP Roles confirm each session's relationship, and the OTC attribute marks routes that may only travel down.