How BGP Works: Internet Routing, Route Hijacks & RPKI (Animated)

The internet is a network of networks, called autonomous systems (AS). BGP is how they tell each other “these IP addresses live with me, send traffic this way”. It works largely on trust, so a wrong announcement can send a bank’s traffic, or a whole country’s, to the wrong place.

1. Peering: two networks agree to talk

Neighbouring routers open a TCP session on port 179, exchange OPEN messages with their AS numbers, then send KEEPALIVEs.

1. OPEN (Bank network → Transit provider): The bank’s router introduces itself.
2. OPEN + KEEPALIVE (Transit provider → Bank network): The session is up.

Wireshark filter:

bgp.type == 1 || bgp.type == 4

2. Announce a route: update: “these addresses are mine”

The bank announces its address block. Each network that passes it on adds its own AS number to the AS path.

1. UPDATE (Bank network → Transit provider): The bank says: this /24 lives with me.
2. UPDATE (Transit provider → Your ISP): The transit provider passes it on, adding its own AS.
3. TRAFFIC (Your ISP → Bank network): Customers reach the real bank.

Wireshark filter:

bgp.type == 2

3. Route hijack: attack: announcing someone else’s addresses

A network (through a mistake or on purpose) announces a more specific slice of the bank’s block. Routers always prefer the most specific route, so traffic for those addresses flows to the wrong network.

1. UPDATE (Hijacking network → Transit provider): A false, more specific announcement.
2. UPDATE (Transit provider → Your ISP): Nobody checks the origin, so it spreads.
3. TRAFFIC (Your ISP → Hijacking network): Customers’ traffic to the bank now goes to the wrong network. HTTPS certificates are the last line of defence.

Wireshark filter:

bgp.type == 2 && bgp.update.path_attribute.as_path contains 64666

4. Rpki & filters: defence: check who may announce what

Address holders publish signed ROAs (“only AS 64500 may announce 203.0.113.0/24, up to /24”). Networks that perform route origin validation drop announcements marked invalid. Prefix filters with customers add another layer.

1. UPDATE (Hijacking network → Transit provider): The transit provider rejects the invalid route.
2. TRAFFIC (Your ISP → Bank network): Traffic keeps going to the real bank.

Check a prefix:

Look up the prefix in an RPKI validator (status: Valid / Invalid / Not found)

FAQ