BGP ORIGIN Manipulation | The Impact on Global Routing

BGP ORIGIN Manipulation and Internet Routing

Border Gateway Protocol, or BGP, functions as the primary routing mechanism for the Internet. It allows Autonomous Systems to dictate how traffic flows across networks by using path attributes. One specific, mandatory attribute known as ORIGIN helps routers determine the best path for data prefixes. While protocol standards require this value to remain unchanged once set by the originating network, recent findings show a massive trend of manipulation. Nearly 70% of observed network paths feature an ORIGIN value different from the original, a practice that shifts traffic patterns and revenue flows between service providers.

The Operational History of ORIGIN

Technically, ORIGIN identifies how a route entered BGP. It carries one of three values: IGP, EGP, or INCOMPLETE. IGP indicates the route is internal to the originating system. EGP represents a defunct protocol from the early Internet, while INCOMPLETE signifies an unknown or external source. Though RFC4271 explicitly states that routers should not modify the ORIGIN value, many transit providers treat it as a tool to gain a competitive edge. By changing an INCOMPLETE or EGP tag to IGP, a provider forces downstream routers to prefer their path during the standard BGP selection process. This behavior essentially turns a technical signal into a revenue-driven mechanism to siphon traffic.

Experimental Analysis of Attribute Rewriting

To measure the scale of this interference, we announced various prefixes with specific ORIGIN values across our global network. By monitoring BGP updates from RIPE RIS and RouteViews, we identified widespread discrepancies. Our methodology tracked how various networks altered these values as prefixes propagated. We found that 10.6% of the Autonomous Systems we analyzed actively changed the ORIGIN to IGP. This behavior is most prevalent among large, central Tier-1 networks. When these dominant providers reset the ORIGIN, they successfully capture additional traffic paths that would otherwise traverse competing networks.

The Case for Deprecation

Internet routing today relies on a flawed premise if the ORIGIN attribute continues to influence path selection. The manipulation of this value creates an uneven landscape where non-compliant networks gain traffic at the expense of those following protocol standards. Given that this attribute serves no modern technical necessity, we suggest that the community revisit the idea of deprecating it. Standardizing the ORIGIN to IGP for all routes would eliminate the incentive for these manipulations. It is time for the IETF to reconsider the future of the ORIGIN attribute to ensure a fairer, more predictable routing environment for every network operator.