The Border Gateway Protocol (BGP) is the routing protocol that binds the global Internet together. It allows Autonomous Systems (ASes) to exchange routing information and express path preferences through a series of path attributes. These attributes are processed sequentially by the BGP path selection algorithm to determine the best path for any given IP prefix. Among these, the ORIGIN attribute is a well-known, mandatory path attribute that has historically indicated how a route was first injected into BGP.
According to RFC 4271, the ORIGIN attribute should be set by the originating router and must not be modified by downstream ASes. However, recent empirical research reveals a starkly different reality: approximately 70% of observed BGP paths across numerous global vantage points carry an ORIGIN value that has been altered from its original state. This widespread manipulation of the ORIGIN attribute has a profound impact on global traffic engineering, routing predictability, and the economic dynamics of transit providers.
Understanding the BGP ORIGIN Attribute and Path Selection
The BGP ORIGIN attribute can take one of three possible values, representing the historical methods of route injection:
- IGP (0): Indicates the route is interior to the originating AS. This is typically set when a prefix is announced via a network statement or interior routing protocol.
- EGP (1): A historical value indicating the route was learned via the obsolete Exterior Gateway Protocol (EGP). It is not intended for use on the modern Internet.
- INCOMPLETE (2): Indicates the route was learned via an unknown or external source, commonly occurring when routes are redistributed into BGP from static or dynamic routing protocols.
On the modern Internet, IGP is the dominant value, representing 89.8% of all observable routes across public BGP collectors like RIPE RIS and RouteViews. INCOMPLETE accounts for 6.7%, while the obsolete EGP value still lingers in 3.5% of routes. During the BGP path selection process, if two routes have equal Local Preference and AS_PATH length, the router evaluates the ORIGIN attribute. The algorithm prefers the path with the lowest ORIGIN value (IGP < EGP < INCOMPLETE). This early-stage tie-breaker makes the ORIGIN attribute a highly attractive target for manipulation.
The Economics of ORIGIN Manipulation
Because the BGP path selection algorithm prioritizes IGP over EGP and INCOMPLETE, downstream transit providers have a strong financial incentive to modify this attribute. By rewriting a route’s ORIGIN to IGP, a transit provider can make its path appear more attractive to downstream customers than a competitor’s path that retains an EGP or INCOMPLETE status. This artificial promotion of the path allows the transit provider to attract more traffic to its links, directly translating into increased transit revenue.
This practice has created a silent arms race among network operators. While public disclosures at industry forums like RIPE 91 (by James Bensley) and LACNIC 45 (by Celsa Sánchez) have spotlighted the issue, they have also highlighted a coordination challenge: rather than waiting for competitors to return to RFC compliance, many operators feel compelled to rewrite the ORIGIN attribute themselves simply to maintain a level playing field.
Real-World Impact: How Path Hijacking by Proxy Works
To understand how this manipulation alters global traffic flows, consider a scenario involving four Autonomous Systems:
- AS64501 originates a prefix with the ORIGIN attribute set to INCOMPLETE.
- It propagates this announcement to its upstream transit providers, AS64502 and AS64503.
- Under standard RFC 4271 behavior, both providers should prepend their own AS to the AS_PATH, preserve the INCOMPLETE value, and forward the announcement to their common customer, AS64504.
- However, seeking a competitive advantage, AS64503 rewrites the ORIGIN attribute from INCOMPLETE to IGP before forwarding it.
- When AS64504 receives both announcements, it compares them. Both paths have identical AS_PATH lengths. However, the path via AS64503 carries the preferred IGP value, while the path via AS64502 carries INCOMPLETE.
- AS64504 selects the route through AS64503, routing all its outbound traffic through the manipulating provider, depriving AS64502 of the traffic and associated revenue.
Methodology: Measuring Global ORIGIN Alteration
To systematically measure the scale of this phenomenon, researchers designed an active measurement experiment utilizing BGP Anycast. Three IPv4 and three IPv6 prefixes were announced globally from multiple peering locations, each configured with a different starting ORIGIN value (IGP, EGP, and INCOMPLETE). After ensuring global propagation, the prefixes were withdrawn to trigger the BGP “path hunting” process, which exposes a wider variety of alternative paths to public collectors.
Data collection relied on the BGPKIT toolkit to parse Multi-threaded Routing Toolkit (MRT) dumps from RIPE RIS and RouteViews, alongside local BGP Monitoring Protocol (BMP) data from border routers. By analyzing raw BGP Update messages rather than static Routing Information Base (RIB) snapshots, researchers captured transient paths and intermediate state changes that would otherwise be missed.
Direct Peer Analysis and Address Family Discrepancies
The first phase of the analysis focused on two-hop AS_PATHs (e.g., “ASX AS13335”), where ASX is a direct peer of the originating network (AS13335). Because the origin state was known, any deviation in the ORIGIN attribute observed at ASX could be directly attributed to that peer. The tables below outline the manipulation behavior observed across direct peers for both IPv4 and IPv6.
IPv4 Direct Peer Manipulation (352 Peers)
| Advertised ORIGIN | Observed IGP | Observed EGP | Observed INCOMPLETE | Observed IGP + EGP | Observed IGP + INCOMPLETE |
|---|---|---|---|---|---|
| IGP | 345 | 3 | 4 | 0 | 0 |
| EGP | 32 | 313 | 4 | 3 | 0 |
| INCOMPLETE | 32 | 3 | 314 | 0 | 3 |
IPv6 Direct Peer Manipulation (315 Peers)
| Advertised ORIGIN | Observed IGP | Observed EGP | Observed INCOMPLETE | Observed IGP + EGP | Observed IGP + INCOMPLETE |
|---|---|---|---|---|---|
| IGP | 308 | 3 | 4 | 0 | 0 |
| EGP | 29 | 280 | 4 | 2 | 0 |
| INCOMPLETE | 29 | 3 | 281 | 0 | 2 |
The data reveals that approximately 10% of direct peers actively modify the ORIGIN to IGP. Conversely, a small number of peers rewrite incoming routes to EGP or INCOMPLETE. Direct outreach to network operators confirmed that some networks intentionally rewrite incoming peer or provider routes to EGP or INCOMPLETE to systematically deprioritize them in favor of customer routes. Additionally, discrepancies between IPv4 and IPv6 behaviors for identical peers suggest inconsistent configuration templates across address families.
Tracking the Culprits: An Iterative Attribution Algorithm
To identify rewriting networks deeper in the global routing table where AS_PATHs exceed two hops, researchers developed an iterative attribution algorithm. This algorithm isolates the specific AS responsible for the modification by maintaining a set of trusted, non-manipulating ASes.
The algorithm operates as follows:
- Seed a trusted set (T) with the originating AS (AS13335), which is known to preserve the original ORIGIN value.
- For each observed AS_PATH, filter out all ASes currently member to T.
- If exactly one AS remains in the filtered path, attribute the observed ORIGIN value to that remaining AS, recording the mapping:
AS → ORIGIN(s). - For each recorded mapping, if the observed ORIGIN matches the originally advertised value, add that AS to the trusted set T. If it differs, add the AS to the set of Modifiers (M).
- If new ASes were added to T in step 4, repeat the process from step 2.
</ol
When applied to the experimental dataset, this algorithm successfully attributed the behavior of 606 out of 802 (75.6%) visible ASes. Of these attributed networks, 64 (10.6%) were identified as active IGP-rewriters.
Tier-1 Dominance and CAIDA AS Rank Concentration
Analyzing the characteristics of the identified modifiers using CAIDA’s AS Rank (which ranks networks based on the size of their customer cone) revealed that ORIGIN manipulation is highly concentrated at the top of the Internet hierarchy. Out of 16 global Tier-1 networks, 6 were found to actively manipulate the ORIGIN attribute to IGP. One prominent Tier-1 network was observed rewriting peer-learned routes to IGP while preserving the original attribute on routes learned from its customers.
Furthermore, cumulative distribution analysis (CDF) of the AS Ranks of all identified modifiers showed that 20.3% of the rewriting ASes fall within the top-50 of the global AS Rank. This indicates that the entities most responsible for altering BGP ORIGIN attributes are large transit providers with massive routing footprints, amplifying the downstream impact of their modifications across the global routing table.
Limitations of Global BGP Visibility
While the empirical data provides clear evidence of widespread manipulation, BGP analysis is subject to inherent visibility limitations. The modern Internet has undergone significant “flattening,” driven by content delivery networks (CDNs) and hyperscalers bypassing traditional transit paths in favor of direct, private peering.
Because public route collectors (such as RIPE RIS and RouteViews) rely on voluntary peering sessions with a limited set of networks, they lack complete visibility into these private interconnection points. Consequently, a significant portion of the global BGP topology remains invisible to public monitors, meaning any global inferences regarding AS behaviors carry an unavoidable margin of uncertainty.
The Case for Deprecating the ORIGIN Attribute
The widespread, systematic manipulation of the ORIGIN attribute undermines its utility as a reliable routing metric. Originally designed to assist in the transition from EGP to BGP, the attribute no longer serves its original technical purpose in a modern, single-protocol Internet. Instead, it has been co-opted as an arbitrary traffic engineering lever that violates the architectural intent of RFC 4271.
This ongoing degradation of routing integrity has led to proposals within the IETF, including an Internet-Draft, recommending the formal deprecation of the ORIGIN attribute in the BGP route selection process. Removing ORIGIN from the decision algorithm would eliminate an arbitrary vector for traffic redirection, forcing networks to rely on more transparent and standardized metrics like AS_PATH length and Local Preference, ultimately improving the stability and predictability of global Internet routing.
Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.