If you open a website hosted in Tokyo, your data does not take the most direct cable. It may well leave Madrid for Frankfurt, hop up to Amsterdam, cross the Atlantic along a path you never imagined and come back another way. Why? Because the route is decided not by your ISP calculating latencies, but by a protocol from 1989 that still governs the internet: BGP (Border Gateway Protocol, the protocol large networks use to exchange routes with each other).
And BGP’s decision does not look for the fastest path. It looks for the most convenient one for whoever announces it. That explains almost everything else.
The internet is not one network: it is tens of thousands of networks shaking hands
Before understanding BGP you have to dismantle an idea: the internet is not a uniform mesh. It is a set of independent networks, each under its own administration and policies. Each one is called an AS (Autonomous System) and is identified by a 32-bit number, the ASN: AS13335 is Cloudflare, AS15169 is Google, AS3356 is Lumen. Today there are on the order of 75,000 autonomous systems with active routes in the public table, and each one has its own interests.
Every AS owns blocks of IP addresses, the prefixes, written in CIDR notation: 203.0.113.0/24 is 256 addresses. The /24 suffix says how many bits identify the network; the higher that number, the smaller and more specific the network.
BGP is the mechanism by which an AS tells its neighbours, “these addresses live behind me”. Its neighbours repeat it to theirs, and the news propagates until the whole world knows how to reach that block. It is a path-vector protocol: every announcement travels with the list of ASes it has crossed, the AS_PATH, which allows loop detection without knowing the global topology. Sessions run over TCP port 179, with KEEPALIVE messages every 60 seconds and a HOLD timer of 180: if the neighbour goes quiet for too long, the session is considered down.
A map of a million routes, rewritten every minute
The global IPv4 table holds roughly a million announced prefixes, plus some 200,000 for IPv6. That table lives in the memory of edge routers, split between the RIB (candidate routes) and the FIB (the ones actually used to forward packets in hardware). That is an enormous amount of state, and it keeps growing.
Inside a single AS, the internal routing technique is called iBGP and comes with an awkward rule: what is learned through iBGP is not re-announced to other internal neighbours. Otherwise you would need a full mesh of sessions between every router. To avoid it, networks use route reflectors, routers that act as mirrors and hand out routes by delegation. Between different ASes the session is eBGP, and that is where policy comes in.
The route is chosen by the contract, not by the distance
When a router receives several routes to the same prefix, it runs a decision process over ordered attributes. The important ones: LOCAL_PREF (preference within the AS, highest wins), AS_PATH length (shortest wins), MED (a hint to the neighbour about where to enter) and the order between eBGP and iBGP routes. Neither latency nor bandwidth appears on that list. An operator may decide that all its traffic leaves through a five-hop path because that transit costs less than a three-hop one.
That is where the business lives: transit (one operator pays another to reach the rest of the internet), peering (two networks exchange traffic for free because both benefit) and IXPs, neutral exchange points such as DE-CIX in Frankfurt or AMS-IX in Amsterdam where dozens of networks connect in the same building. Add a widely used engineering trick: AS_PATH prepending, repeating your own ASN several times in the announcement so others see a long path and do not use you as transit.
The detail that decides hijacks: how specific your prefix is
When two routes compete, the more specific one wins before the better one: that is longest prefix match. An announcement of 203.0.113.0/25 beats one of 203.0.113.0/24 even if it arrives through the worst path in the world. That behaviour is the foundation of route hijacking: announce a sub-prefix inside your block and half the internet will start sending traffic to me. The same property is used as a defence: during a hijack, the victim announces sub-prefixes to get its addresses back, as Apple did in 2022.
It is worth separating two different accidents. A route leak is a spill: a network re-announces to its neighbours routes it learned from its providers, with no right to do so, and unknowingly becomes global transit. A hijack is an announcement of a prefix that is not yours. And there is a particularly nasty variant, the “stealth” hijack: the fake route is never announced to the owner itself, so the owner sees nothing wrong while its traffic is diverted.
When the map breaks: from 1.1.1.1 to a silent sub-prefix
Recent examples summarise the problem best. In June 2024, a combination of a hijack and a route leak left Cloudflare’s 1.1.1.1 DNS resolver unreachable from more than 300 networks in 70 countries — and that is despite Cloudflare being an early adopter of cryptographic route validation. In July 2022, an announcement from Rostelecom redirected part of Apple’s network for more than twelve hours. And in February 2025, researchers documented a stealth case: the sub-prefix 203.127.225.0/24, belonging to Singapore’s SingNet, was announced by a Philippine network with no relationship to it, and traffic from major providers was diverted for weeks without the victim ever seeing the fake route in its control plane.
According to public industry counts, more than 1,430 such incidents have been documented since 2020, around fourteen a day. Most are misconfigurations, not attacks. The underlying problem is always the same: BGP was born in a small community of mutual trust and never included a way to check that whoever announces a prefix is entitled to announce it.
Signing the map: RPKI, ROAs and origin validation
The most widely deployed answer is RPKI (Resource Public Key Infrastructure): a certificate hierarchy managed by the regional registries (RIPE NCC, ARIN, APNIC and company) where the holder of a block publishes a ROA (Route Origin Authorization). A ROA states, in cryptographic terms: this prefix may only be originated by this ASN, and at most with this prefix length. Routers download that information through the RTR protocol and classify every announcement as valid, invalid or unknown; depending on policy, they accept it, reject it or downgrade its preference. That last option, fail-open mode, keeps the internet standing if an RPKI repository stops responding, but it also leaves the door ajar.
The current state is one of half-finished transition: more than half of announced prefixes are already covered by a ROA, but only around 25% of networks run origin validation with real filtering. A single major provider that does not validate is enough for a fake announcement to keep propagating halfway around the world. In parallel, other pieces are being developed: BGPsec, which would sign the entire AS_PATH (adoption is scarce because verifying signatures in the forwarding path is expensive), ASPA to detect route leaks, agreed best practices such as MANRS, and alternative architectures like SCION, which instead of trusting the announced route builds explicit, verifiable paths between domains.
What a small network can do
For anyone managing their own addresses, the list is concrete: publish objects in the registry (IRR), create ROAs with the correct maximum length, sign your announcements, monitor your own visibility and buy transit from providers that apply strict validation. For anyone who wants to watch the state of the map, there are open tools: Cloudflare Radar, the MANRS observatory and operators’ looking glasses show routes and alerts in real time.
In the end, the amazing thing is not that BGP breaks now and then, but that it works almost always. The internet does not rest on verification, but on agreements between operators who mostly do not know each other and who, despite everything, keep their word. End-to-end encryption protects the content of your data; nobody fully protects the path it travels.
