BGP (Border Gateway Protocol) is the path-vector routing protocol that exchanges reachability information between autonomous systems (AS), the independently operated networks of providers, enterprises and content platforms. In networking and routing, it is the protocol that connects the Internet together: every route between networks owned by different organizations is ultimately learned through BGP.
The current version, BGP-4, is specified in RFC 4271 and has been extended many times, most importantly by multiprotocol extensions that carry IPv6, VPN and EVPN routes. Unlike interior protocols such as OSPF, BGP is designed for policy and scale rather than for finding the shortest path quickly.
How BGP sessions and route exchange work
Two BGP routers, called peers or neighbors, establish a session over TCP port 179. They exchange OPEN messages to agree on parameters, then send UPDATE messages that announce or withdraw prefixes. After the initial full exchange, BGP sends only incremental changes, which keeps it efficient even with very large tables.
Each route carries path attributes. The most important is the AS_PATH, the list of autonomous systems the announcement has passed through. A router rejects any route that already contains its own AS number, which is how BGP prevents routing loops between networks. The table lists the BGP message types.
| Message | Purpose | When it is sent |
|---|---|---|
| OPEN | Exchanges AS number, router ID, hold time and capabilities | At session start |
| UPDATE | Announces new routes or withdraws old ones | Whenever reachability changes |
| KEEPALIVE | Confirms that the peer is alive | Typically every 60 seconds |
| NOTIFICATION | Reports an error and closes the session | On protocol or configuration errors |
| ROUTE-REFRESH | Requests a peer to resend its routes | After a policy change |
The default hold time is 180 seconds, so a silent peer may take up to three minutes to be declared down. Operators often add BFD (Bidirectional Forwarding Detection) to detect failures within milliseconds.
eBGP and iBGP
BGP runs in two forms. External BGP (eBGP) connects routers in different autonomous systems, and internal BGP (iBGP) distributes externally learned routes among routers within the same AS. The rules differ in important ways, summarized below.
| Property | eBGP | iBGP |
|---|---|---|
| Peers | Different AS numbers | Same AS number |
| AS_PATH handling | Local AS is prepended | Unchanged |
| Route propagation | Routes passed on to other peers | Routes not passed to other iBGP peers |
| Administrative distance (common default) | 20 | 200 |
| Scaling technique | Not needed | Route reflectors or confederations |
Because iBGP routers do not re-advertise iBGP routes, a plain design requires a full mesh of sessions. Large networks avoid this with route reflectors, which re-advertise routes to their clients, while an interior protocol such as OSPF or IS-IS provides reachability to the BGP next hops.
The BGP best-path selection process
When a router learns several paths to the same prefix, it selects one best path through an ordered list of comparisons. Operators influence traffic by adjusting the attributes early in this list, which is the core of BGP traffic engineering.
| Attribute | Preferred value | Typical use |
|---|---|---|
| Weight (vendor-specific) | Highest | Local preference on a single router |
| LOCAL_PREF | Highest | Choosing the outbound exit for the whole AS |
| AS_PATH length | Shortest | Prepending to make inbound paths less attractive |
| Origin | IGP over incomplete | Rarely used deliberately |
| MED | Lowest | Suggesting an entry point to a neighboring AS |
| eBGP over iBGP | eBGP | Prefer routes learned directly from neighbors |
| IGP cost to next hop | Lowest | Hot-potato routing to the nearest exit |
The result is policy-based routing at Internet scale: an AS prefers routes from paying customers over peers, and peers over transit providers, regardless of which path is technically shorter.
BGP converges slowly by design. After a failure, routers may try several alternative paths in turn, an effect known as path hunting, and update pacing timers such as the minimum route advertisement interval spread changes over seconds or minutes. Features such as BGP Add-Path and prefix-independent convergence keep backup paths ready, so forwarding can switch before the control plane has fully recalculated.
BGP compared with other routing methods
BGP is one of several ways a router fills its routing table, and it is chosen when policy, scale or multiple administrative domains matter. Static routes and default gateways suit simple edges, while OSPF suits fast convergence inside one organization.
The full global IPv4 table exceeds one million prefixes, and the IPv6 table is in the range of a couple of hundred thousand and growing. Routers that carry full tables need enough memory and forwarding capacity for both, while smaller networks often accept only a default route and a few customer prefixes from their providers. Inside data centers, BGP is also popular as a simple and predictable underlay protocol for leaf-spine fabrics.
BGP security and common failures
BGP was designed on the assumption that peers trust each other’s announcements. As a result, incorrect or malicious announcements can redirect traffic across the Internet. The table lists typical incidents and their countermeasures.
| Incident | Cause | Countermeasure |
|---|---|---|
| Prefix hijack | An AS announces prefixes it does not hold | RPKI route origin validation |
| Route leak | Routes from one provider passed to another | Strict export filters and peer-lock policies |
| More-specific hijack | Longer prefix wins in forwarding | RPKI with maximum prefix length |
| Session reset storm | Excessive prefixes from a peer | Maximum-prefix limits |
| Self-inflicted outage | Withdrawing own prefixes by mistake | Change review and staged rollout |
RPKI (Resource Public Key Infrastructure) lets address holders publish signed Route Origin Authorizations, and routers drop announcements whose origin AS is invalid. Path validation through BGPsec exists but is not widely deployed, so filtering and monitoring remain essential.
Put simply
The Internet is made of tens of thousands of separate networks run by different companies. BGP is how these networks tell each other which addresses they can reach, much like airlines publishing which cities they fly to and through which hubs.
Each network then chooses its preferred route, not only by distance but also by business agreements. When a network announces something wrong, traffic can go to the wrong place, which is why BGP mistakes can cause large outages.
In practice
A regional e-commerce company obtains its own AS number and a /24 IPv4 prefix and connects to two transit providers in different cities. Each provider sends only a default route, and the company announces its prefix to both over eBGP sessions with BFD and maximum-prefix limits.
To keep most inbound traffic on the cheaper provider, the network engineer prepends its AS twice on announcements to the second provider and sets a higher LOCAL_PREF for outbound traffic through the first. The company also publishes a Route Origin Authorization for its prefix. When the first provider later suffers a fiber cut, BFD drops the session in under a second and traffic shifts to the second provider, so customers see no noticeable interruption.