Shocking 70% Rewrite Rate! BGP's ORIGIN Attribute Is Being Secretly Manipulated by Transit Providers

Hi, I'm Shii-chan! Today I found a pretty surprising research result about BGP, the protocol that underpins how the Internet routes traffic, and I want to share it with you!

Cloudflare Blog blog.cloudflare.com

What was announced?

This comes from a research post on the Cloudflare Blog (its Engineering blog), titled "BGP ORIGIN attribute manipulation and its impact on the Internet." Cloudflare did in-depth testing on the ORIGIN attribute, a piece of information carried in BGP routes, and found that it gets rewritten far more often than you'd expect.

The results are striking: Cloudflare found that about 70% of the IPv4 paths and about 67% of the IPv6 paths it observed had their ORIGIN attribute rewritten to IGP by transit providers, in order to make their own routes look more attractive and pull in more traffic.

Based on these findings, Cloudflare argues that the ORIGIN attribute should no longer be used in route selection at all, and calls for deprecating it.

Why it matters

First, a bit of background: BGP (Border Gateway Protocol) is the protocol that autonomous systems (ASes), the building blocks of the Internet, use to exchange routing information with each other. It's essentially the Internet's way of finding directions.

When BGP has multiple candidate routes, it compares them against a series of criteria, in order, to decide which one to use. One of those criteria is the ORIGIN attribute. Local Preference is compared first, then AS_PATH length, and only if those are tied does ORIGIN come into play.

ORIGIN has three possible values:

• IGP (0): the route originated inside the AS itself
• EGP (1): learned via the now-deprecated legacy EGP protocol
• INCOMPLETE (2): the route's origin is unknown, or it was learned from an external source

IGP is the highest-priority value. So while ORIGIN is supposed to honestly reflect how a route came to exist, simply rewriting it to IGP is enough to make that route more likely to get picked over others. That's exactly the kind of loophole this research is about: when it gets used as a trick to win route selection rather than to convey real information, it creates an unfair situation where operators who play by the rules end up losing out. That's why this investigation matters so much.

What changes

Cloudflare concludes that "if the answer is no" when asking whether ORIGIN still serves any meaningful purpose, and proposes deprecating it by gradually reducing its influence on route selection. Specifically, Cloudflare calls for vendor implementations to treat ORIGIN as IGP on all received and advertised routes, and urges renewed discussion of the IETF draft "Scrubbing BGP ORIGIN Attribute."

If this proposal takes hold, the loophole of rewriting ORIGIN would effectively disappear, making route selection fairer and more predictable across the board. Since this touches on the reliability of Internet routing as a whole, it's a proposal the networking industry can't really afford to ignore.

Dive Deep

Cloudflare's methodology was pretty thorough.

• Direct peer testing: Cloudflare advertised routes with different ORIGIN values to 352 direct IPv4 peer ASes and 315 direct IPv6 peer ASes, and observed how each peer actually treated them
• Long-path analysis: using a set of trusted ASes, including Cloudflare itself, as a baseline, Cloudflare tracked where within the AS_PATH the ORIGIN attribute changed
• Data sources: public datasets like RIPE RIS and RouteViews, plus Cloudflare's own BMP (BGP Monitoring Protocol) collection data

The post is full of concrete numbers.

• Overall, 89.8% of routes are set to IGP, 3.5% to EGP, and 6.7% to INCOMPLETE
• About 10% of direct peers were found to be rewriting ORIGIN
• Of 606 ASes with visibility (out of 802 total), 64 ASes (about 10.6%) were rewriting to IGP
• 26% of the top 50 ASes and 20% of the top 100 ASes were rewriting ORIGIN, showing that larger ASes are more likely to do this
• 6 out of 16 Tier-1 ISPs (37.5%) were found to be rewriting ORIGIN
• Rewriting to IGP gained an extra 12 routes (an 18% increase) for IPv4 and an extra 33 routes (a 40% increase, 11 of them via Tier-1 networks) for IPv6

These numbers make it clear that larger ASes are more actively manipulating the ORIGIN attribute, and that this manipulation has a real, measurable effect on where traffic actually flows.

Wrap-up

• About 70% of IPv4 BGP paths and 67% of IPv6 paths had their ORIGIN attribute rewritten to IGP
• The motive is to attract more traffic, and revenue, by making a provider's own routes look more attractive
• Larger ASes, including 6 out of 16 Tier-1 ISPs, are more likely to rewrite ORIGIN
• The rewriting boosted traffic attraction by 18% for IPv4 and 40% for IPv6
• Cloudflare proposes deprecating ORIGIN's influence on route selection and standardizing vendor implementations around it

This is a great read if you're a network engineer, work at an ISP or transit provider, or are just curious about what really happens behind the scenes of BGP route selection!