You open a website in Madrid and the packets reach a server in Virginia passing through a dozen networks owned by different companies that compete with each other and share no boss. There is no central map saying where your traffic should go. What exists is a permanent conversation between neighbours: BGP (Border Gateway Protocol), the protocol that has been holding up the internet we use since 1989.
An internet made of networks that do not know each other
The unit of the internet is not the computer, it is the autonomous system (AS): a set of networks managed by a single organisation under one common policy. Each one has a number, the ASN. Your fibre operator is one AS, the cloud hosting this site is another, and the big content delivery networks (Google, Cloudflare, Amazon) are ASs present in hundreds of cities. Some 75,000 ASs advertise routes.
A prefix is the block of addresses an AS claims to know how to reach, for example 203.0.113.0/24. BGP does not route machines: it routes blocks. And its message is always the same: «I know how to reach this prefix, and I leave through here to do it».
Neighbours, not a map
ASs do not talk to everyone: they talk to those with whom they have an established session, the peering. That session runs over TCP on port 179 and stays alive with keepalive messages every 60 seconds, with a 180-second expiry timer: if the neighbour goes quiet, the session drops and all its routes are withdrawn at once. There is external BGP (eBGP), between different networks, and internal BGP (iBGP), which distributes inside an AS what was learned outside.
Here lies the key to the design: an AS does not advertise everything it knows, it advertises what suits it. Global visibility is not a right, it is a commercial and technical decision made by each operator.
The whole path, not the next hop
Unlike internal routing protocols, which pick the shortest path by cost, BGP is a path-vector protocol. Every route travels with an attribute called AS_PATH: the list of ASs it has passed through. It serves two purposes. First, it prevents loops: if a router sees itself in the list, it discards the announcement. Second, it acts as a metric: all else being equal, the path with fewer ASs wins.
The other attributes are the fine print explaining why your traffic makes decisions that sometimes look irrational. LOCAL_PREF expresses preference inside your own network and overrides everything else. MED (Multi-Exit Discriminator) suggests to a neighbour which of your several connections to enter through. The next hop and the internal protocol metric decide the final leg.
When a route changes, the router does not recompute a map: it propagates the change to its neighbours, who propagate it to theirs. That is convergence, and it costs seconds or minutes. During that window, different machines at the same operator may disagree about where a network is. The internet is coherent almost always, not always.
When a neighbour makes a mistake, or lies
BGP was designed in a community of trust, and by default it does not check who has the right to advertise a prefix. Anyone with a session can say «I know how to reach this block», and if their announcement looks more attractive (shorter path, better LOCAL_PREF), the rest of the world will send them the traffic. That is a route hijack, and it has happened both by mistake and on purpose.
In 2008, a Pakistani operator accidentally advertised YouTube’s prefix while trying to block the site locally; the announcement escaped to its provider and for about two hours worldwide traffic to YouTube fell into a black hole. In 2021, a configuration change withdrew Facebook’s routes from its own routers: the company disconnected itself from the internet, and its internal systems with it.
The technical answer is RPKI (Resource Public Key Infrastructure): a certificate system where address registries sign authorisations called ROAs stating which AS may originate each prefix. A router validating origin can reject an unauthorised announcement. It is no panacea (it only covers the origin, not the whole path) and adoption is uneven, but it is the difference between trusting and verifying. Add to that the MANRS good practices, adopted by many operators.
The internet does not work because someone commands it, but because tens of thousands of neighbours tell each other the truth about what they see. BGP is that conversation: robust, surprisingly fragile and, to this day, without a replacement.
