Border Gateway Protocol — Internet Routing Visualizer
Click a source AS, then click a destination AS to animate route propagation.
| Network | Next Hop | AS Path | Local Pref | MED | Origin | Weight |
|---|
Sequence of AS numbers the route has traversed. Used for loop prevention — if your own AS number appears in the path, the route is discarded. Shorter paths are preferred.
Shorter = BetterIP address of the border router that should be used as the next hop to reach the advertised prefix. For eBGP, this is set to the advertising router's IP; for iBGP, it is not modified.
Must be reachableUsed within an AS (iBGP) to signal the preferred exit point. Higher value wins. Not propagated to eBGP peers. Default is 100. Operators raise it to prefer a specific path.
Higher = BetterHint to neighboring ASes about the preferred entry point when multiple links exist. Lower value wins. Only compared between routes from the same neighboring AS.
Lower = BetterIndicates how the route entered BGP. IGP (i) — injected via network command. EGP (e) — learned from old EGP. Incomplete (?) — redistributed from another protocol. IGP is most preferred.
IGP > EGP > Incomplete32-bit policy tags attached to routes. Well-known values: NO_EXPORT 65535:65281, NO_ADVERTISE 65535:65282, BLACKHOLE 65535:666. Used extensively for traffic engineering.
Cisco-proprietary attribute. Local to the router — never propagated. Highest wins. Evaluated first in Cisco's BGP decision process. Default is 0 for learned routes, 32768 for local.
Highest = Best (local only)Set when a router aggregates (summarizes) more-specific prefixes into a less-specific one. AGGREGATOR identifies the AS and router that did the aggregation. Informs peers that information may have been lost.
InformationalInitial state. BGP is waiting for a Start event (e.g., operator enables BGP or peer comes up). Resources are initialized. The router refuses all incoming BGP connections.
First message sent after a TCP connection is established. Negotiates the BGP session parameters. Both peers exchange OPEN messages and verify compatibility.
| Version | BGP version number (current: 4) |
| My Autonomous System | Sender's AS number (2-byte or 4-byte via capability) |
| Hold Time | Proposed hold time in seconds; smaller value is negotiated (default 90s) |
| BGP Identifier | Router ID — highest IP or manually set 32-bit value |
| Optional Parameters | Capabilities: 4-byte ASN, MP-BGP, Route Refresh, etc. |
The workhorse of BGP. Advertises new routes (NLRI + path attributes) and/or withdraws previously advertised routes. A single UPDATE can carry multiple prefixes and withdrawals.
| Withdrawn Routes Length | Length of withdrawn routes field in bytes |
| Withdrawn Routes | List of IP prefixes being removed from service |
| Total Path Attribute Length | Length of path attributes field |
| Path Attributes | AS_PATH, NEXT_HOP, LOCAL_PREF, MED, COMMUNITY, etc. |
| NLRI | Network Layer Reachability Information — list of advertised prefixes |
Sent periodically to keep the session alive. No payload — just the 19-byte BGP header. Sent every 1/3 of the hold time (default every 30s). Also sent in response to OPEN to acknowledge the session.
| Marker | 16 bytes of 0xFF — synchronization and authentication marker |
| Length | 19 (header only) |
| Type | 4 (KEEPALIVE) |
Sent when an error is detected. Immediately closes the TCP connection after sending. The receiving router must reset the session.
| Error Code | 1=Header, 2=OPEN, 3=UPDATE, 4=Hold Timer, 5=FSM, 6=Cease |
| Error Subcode | Further qualification of the error type |
| Data | Variable-length field with diagnostic data |
Requests a peer to re-send its routing table for a given address family without tearing down the session. Used after policy changes. Both peers must advertise the Route Refresh capability in OPEN.
| AFI | Address Family Identifier (1=IPv4, 2=IPv6) |
| Reserved | 1 byte, must be 0 |
| SAFI | Subsequent AFI (1=unicast, 2=multicast, 128=MPLS VPN) |
AS15169 (Google) announces 8.8.8.0/24. All traffic destined for 8.8.8.x is forwarded to Google's routers via the best path.
Malicious AS announces 8.8.8.0/25 — a more-specific prefix. BGP always prefers the longer prefix match. Traffic to the first half of 8.8.8.x now flows to the attacker.
Resource Public Key Infrastructure (RPKI) lets the legitimate owner cryptographically sign their prefix. A Route Origin Authorization (ROA) declares which AS is allowed to originate a prefix and the maximum prefix length. RPKI-validating routers drop invalid announcements.
2010: China Telecom hijacked ~37,000 prefixes for 18 min.
2018: Mylobot malware hijacked AWS routes to steal crypto.
2022: Vodafone AS55410 leaked routes affecting Facebook.
| Property | eBGP | iBGP |
|---|---|---|
| Peers | Different ASes | Same AS |
| TTL default | 1 (direct links only) | 255 (loopback possible) |
| NEXT_HOP | Set to self | Unchanged (neighbor's IP) |
| LOCAL_PREF | Stripped on export | Propagated unchanged |
| AS_PATH | Own AS prepended | Unchanged |
| Split horizon | N/A | Routes NOT re-advertised to other iBGP peers |
| Full mesh | Not required | Required (or Route Reflector / Confederation) |
| Admin distance | 20 | 200 |
| MED propagated | To neighbors (optional) | Yes, within AS |