Autonomous systems & BGP

How tens of thousands of independently run networks agree on where every address lives: autonomous systems, who hands out numbers, interior and exterior routing, BGP messages and best-path selection, who pays whom, exchange points, anycast, leaks and hijacks, and the cables underneath. Builds on Networking fundamentals; IP addresses and DNS are in Communication networks.

A network of networks

Nobody runs "the internet". It is roughly 80,000 separately operated networks (79,920 in the CIDR Report (opens in a new tab) on 2026-11-11), each with its own routers, its own rules and its own business deals, that agree to pass traffic to each other. Think of countries: each builds its own roads and picks routes inside its borders, and border crossings exist only where two countries have signed an agreement.

Two separate jobs follow from that:

• Inside one network, find the fastest path between its own routers. Every router can know the whole internal map, so this is a shortest-path problem.
• Between networks, learn which network can deliver which addresses, and choose among offers by policy: who is a customer, who is paying, who is trusted. Nobody sees the whole map.

Autonomous systems and ASNs

An autonomous system is "a connected group of one or more IP prefixes run by one or more network operators which has a single and clearly defined routing policy" (RFC 1930). A home or a small company with one ISP does not need one: its addresses are part of the ISP's AS. You need your own ASN when you connect to two or more providers (multihoming) and want to announce your own prefixes to both.

ASNs started as 16-bit numbers (0–65,535). They ran short, so RFC 6793 made them 32-bit (0–4,294,967,295); a 32-bit ASN is usually written as a plain number (AS4200000000), occasionally in "asdot" form (64086.59904).

Some well-known ASNs: AS15169 Google, AS13335 Cloudflare, AS16509 Amazon, AS8075 Microsoft, AS32934 Meta, AS3356 Lumen, AS1299 Arelion, AS2914 NTT, AS174 Cogent.

Who hands out numbers

Addresses and ASNs are unique worldwide because they are delegated down one tree:

• IPv4 is used up. IANA handed out its last free blocks in 2011 and the RIRs have since run through their normal pools; new IPv4 space mostly comes from transfers between holders, and prices are set by that market.
• IPv6 is plentiful. An ISP typically receives a /32 (65,536 /48s) and gives each customer site a /48 or /56; see Building a network for plans.
• Each RIR runs a public whois database (who holds what, abuse contacts) and a certificate authority for RPKI (who may announce what, see defenses).

Prefixes and aggregation

Routers don't store a route per address; they store prefixes. 208.65.152.0/22 means "the first 22 bits are fixed": 1,024 addresses, 208.65.152.0 to 208.65.155.255. To forward a packet, a router picks the matching prefix with the most fixed bits, the longest-prefix match: a /24 beats a /22 that also contains the address.

Aggregation announces one short prefix instead of many long ones. Four neighboring /24s become one /22:

Every route the whole internet accepts ends up in the table of every router that carries the full internet table (the default-free zone, routers with no default route). That table held about 1.09 million IPv4 and 265,000 IPv6 prefixes in November 2026 (CIDR Report), and routers keep it in fast, expensive memory. So operators aggregate where they can, and most networks filter out IPv4 prefixes longer than /24 and IPv6 prefixes longer than /48: those are the smallest blocks you can expect the whole internet to accept.

Networks still announce more-specific prefixes on purpose, to steer traffic (send /24s for half the block via one provider) or to keep working when a less specific route is hijacked.

Inside and between networks

Routing protocols split along the AS boundary. An interior gateway protocol (IGP) runs inside one AS; the exterior protocol, BGP, runs between them.

• Link-state: every router floods a description of its own links (OSPF LSAs, IS-IS LSPs), so all routers build the same map and each runs Dijkstra's shortest-path-first algorithm on it. Once a failure is detected it reconverges in well under a second to a few seconds, and it scales to networks of hundreds or a few thousand routers.
• That cannot work between ASes: nobody would share their internal map, it would be far too big, and "shortest" is not what networks want; they want "cheapest and allowed".
• Path-vector: BGP shares only "I can reach this prefix, and here is the list of ASes on the way". The list doubles as loop protection.
• Inside an AS, the IGP carries routes to the routers themselves (their loopback addresses), and iBGP rides on top of it carrying the external routes. iBGP routers don't pass iBGP-learned routes to other iBGP routers, so they need a full mesh of sessions or route reflectors (RFC 4456) that relay for everyone.

How BGP works

BGP version 4 (RFC 4271) is a conversation between two routers that an operator has configured as neighbors (also called peers). There is no discovery: both sides list each other's address and ASN.

• The session is a single TCP connection to port 179. TCP handles delivery, so BGP only sends what changed.
• On start-up the neighbors exchange their full tables (a full table from a transit provider is about a million IPv4 routes), then only incremental updates.
• The session walks through states Idle → Connect → Active → OpenSent → OpenConfirm → Established. A session stuck in Active usually means TCP can't connect: a wrong address, a firewall, or the other side not configured yet.

The hold time is how long a router waits for any message before declaring the neighbor dead and throwing away all its routes. RFC 4271 suggests 90 seconds; Cisco and several others default to 180. Faster failure detection uses BFD alongside (see Building a network).

Withdrawing a route is not a separate message: it is an UPDATE with the prefix in its "withdrawn routes" field. Each router that loses the route tells its own neighbors, so the withdrawal ripples outward exactly like the announcement did.

In reality each hop takes from milliseconds to tens of seconds: routers batch updates (the MRAI timer, minimum route advertisement interval) and process them in software. Withdrawals are often slower than announcements because routers first try every other path they have heard of (path hunting) before giving up.

Path attributes

Every route in an UPDATE carries path attributes, the facts a router uses to choose.

Well-known communities include NO_EXPORT (65535:65281, don't pass outside the receiving AS) and BLACKHOLE (65535:666, RFC 7999: drop traffic to this prefix, used against DDoS attacks). Providers also publish their own: "tag your route X:3 and we prepend three times toward peers".

How a route spreads

• Loop prevention: a router drops any route whose AS_PATH already contains its own ASN.
• Prepending: an AS can add its own ASN several times (64500 64500 64500) to make a path look longer, so that other networks prefer a different link into it. It is a blunt tool: anyone who ranks routes by LOCAL_PREF first ignores it.
• Path length is not distance. Three ASes can span three continents or one city. BGP knows nothing about latency or bandwidth unless operators encode it in policy.

Choosing the best path

When a router holds several routes for the same prefix, it runs the same comparison every time and stops at the first step that separates them. The order below is the common one (Cisco, Juniper, FRR, BIRD and others agree on the core; details vary by vendor):

Policy (step 3) almost always decides. Shortest path (step 5) is the first "distance" signal, and step 9 means each network hands traffic off as soon as it can, so the path from A to B and the path from B to A are often different (asymmetric routing).

Who pays whom

Links between ASes carry money as well as packets. There are three common relationships:

Those prices produce the export rules, also called "valley-free" routing (Lixin Gao, 2001): a network passes along routes only where someone pays it to carry the traffic.

So every valid path climbs zero or more customer → provider links, crosses at most one peering link, then descends. A path that goes down and up again, through a customer between two of its providers, is a valley: the customer would be carrying traffic between its providers for free, and its links would usually melt. That is what a route leak looks like.

• Tier 1: a network that reaches every destination without buying transit, by peering with all the other Tier 1s. There is no official list; commonly named ones include Lumen (AS3356), Arelion (AS1299), NTT (AS2914), Cogent (AS174), GTT (AS3257) and Tata Communications (AS6453).
• Tier 2: peers widely but still buys some transit. Tier 3 (or stub): buys all its connectivity.
• The hierarchy has flattened: the largest content and cloud networks (Google, Meta, Netflix, Amazon, Microsoft) run their own global backbones and peer directly with access ISPs, so much of the traffic people use never touches a Tier 1.

Where networks meet

Interconnection is physical: two routers need a cable between them, so networks gather in the same buildings.

• A route server (RFC 7947) doesn't add its own ASN to the path or change the next hop, so routes look as if they came straight from the member, and traffic flows member to member across the switch; the route server never carries a data packet. BIRD and OpenBGPD are common implementations.
• Many IXPs are run as non-profits or member associations, and members pay a port fee rather than for traffic. The largest, such as IX.br São Paulo and DE-CIX Frankfurt, each connect over a thousand networks.
• PeeringDB (opens in a new tab) is the shared directory: which networks are present at which exchanges and facilities, their peering policies and contacts.

Anycast

Normally one prefix has one origin. Anycast announces the same prefix from many sites at once. Every router simply picks its best route as usual, so each user's packets end up at whichever site is closest in BGP terms: usually, though not always, the nearest geographically.

• The DNS root servers are anycast: 13 named identities (a.root-servers.net to m.root-servers.net), run by 12 operators, served from about 2,000 instances (root-servers.org (opens in a new tab)). So are public resolvers such as 1.1.1.1 and 8.8.8.8, and most CDNs.
• Failover is automatic: a site that withdraws its route stops attracting traffic, and its users move to the next-best site within seconds to minutes.
• A DDoS attack gets split across every site instead of landing on one.
• Routes are stable enough that TCP works over anycast, but a route change mid-connection can send packets to a different site that knows nothing about the connection, which resets it. CDNs keep their announcements steady and mitigate the rest.
• Load balancing inside a site is a separate layer; see System design.

When routing goes wrong

BGP trusts what neighbors say. Two kinds of mistakes (or attacks) follow:

• A hijack: an AS announces a prefix it doesn't hold, or a more specific part of it. Longest-prefix match then sends traffic to the wrong place.
• A route leak (RFC 7908): a route is passed on beyond where it should go, typically a customer re-announcing one provider's routes to another provider: the valley in the diagram above.

Defenses

• ROV results are valid (a ROA matches), invalid (a ROA exists but the origin or length is wrong) or not found (no ROA; accepted as before). Validators such as Routinator, rpki-client and FORT feed the results to routers.
• Coverage has grown fast: by 2026 roughly two-thirds of routed prefixes have a ROA, depending on how you measure. A ROA for 208.65.152.0/22 with maximum length 22 would make the 2008 /24 invalid wherever ROV is on; Cloudflare noted the same of the 2019 leaked more-specifics.
• Keep ROAs tight: a maximum length longer than you actually announce lets a hijacker announce a more-specific with your ASN as origin.

The physical internet

BGP draws a map of agreements; under it is glass. Every AS adjacency is a real cable between two routers, and nearly all long-distance traffic travels as light in optical fiber.

• Submarine cables cross oceans: TeleGeography tracks more than 600 active and planned systems and over 1.5 million km in service (2026). Each lands at a cable landing station on the coast, then runs inland to data centers.
• Terrestrial backbones run along railways, highways and pipelines between a few dozen hub cities, where colocation facilities and IXPs cluster.
• Light in fiber covers about 200 km per millisecond, so distance sets a floor on latency that no protocol removes.
• Cables get cut, mostly by ship anchors and fishing gear. BGP reroutes around a cut within seconds to minutes, but the detour can add tens of milliseconds and crowd the remaining cables until a repair ship fixes the break.

How fiber, DWDM and submarine systems work is in Wired networks; the full trip of one packet across all of this is in A packet's journey.

Try it

Look up who announces an address, what an AS publishes, and whether a route is RPKI-valid. Network commands for your own machine are in Sysadmin.

# Which AS announces this address? (Team Cymru, bgp.tools)
whois -h whois.cymru.com " -v 1.1.1.1"
whois -h bgp.tools " -v 8.8.8.8"
 
# Registry record for an AS, and its IRR route objects
whois AS13335
whois -h whois.radb.net -- '-i origin AS13335' | grep ^route
 
# Is this origin allowed to announce this prefix? (RPKI)
curl -s "https://stat.ripe.net/data/rpki-validation/\
data.json?resource=13335&prefix=1.1.1.0/24" \
  | jq -r .data.status
# valid
 
# Which exchanges does a network peer at? (PeeringDB)
curl -s "https://www.peeringdb.com/api/netixlan?asn=13335" \
  | jq '.data | length'
 
# The AS of every hop on the way
traceroute -A example.com
mtr -rwz -c 20 example.com

References

• RFC 4271: A Border Gateway Protocol 4 (BGP-4) (opens in a new tab): messages, attributes, the decision process
• RFC 1930: Guidelines for creation, selection, and registration of an AS (opens in a new tab): the definition of an AS
• IANA Autonomous System Numbers registry (opens in a new tab): reserved, private and documentation ranges
• IANA: Number resources (opens in a new tab): how IANA delegates to the RIRs
• RFC 6811: BGP Prefix Origin Validation (opens in a new tab): valid, invalid and not found
• RFC 7947: Internet Exchange BGP Route Server (opens in a new tab): how route servers behave
• RFC 7908: Problem Definition and Classification of BGP Route Leaks (opens in a new tab): leak types
• ASPA-based AS_PATH Verification (IETF draft) (opens in a new tab): current ASPA status
• CIDR Report (opens in a new tab): daily AS counts and table sizes
• RIPE NCC: YouTube hijacking, a RIS case study (opens in a new tab): the 2008 timeline
• Cloudflare: How Verizon and a BGP optimizer knocked large parts of the internet offline (opens in a new tab): the 2019 leak
• Meta Engineering: More details about the October 4 outage (opens in a new tab): the 2021 cause, first-hand
• Cloudflare: Understanding how Facebook disappeared from the internet (opens in a new tab): the 2021 outage as seen from outside
• MANRS (opens in a new tab): the routing security norms and who has signed up
• Root Server Technical Operations (opens in a new tab): root server operators and anycast sites
• TeleGeography Submarine Cable Map (opens in a new tab): every cable and landing station