What is BGP, and why does it sometimes break the internet?
Border Gateway Protocol is how independent networks tell each other which addresses they can reach. It is the routing system the entire internet depends on — and it works largely on trust, which is the source of its problems.
What it does. Each network — an autonomous system — announces the blocks of IP addresses it is responsible for. Neighbours receive those announcements, add themselves to the path, and pass them on. Every router builds a picture of which neighbour to send traffic to for any destination. When routes change, updates propagate across the internet within seconds to minutes.
Why it is fragile. BGP was designed for a small network of mutually trusting operators, and that assumption never got fully replaced. A network can announce any address block, and by default its neighbours will believe it.
Route hijacking. A network announces addresses it does not own, and traffic for those addresses is drawn toward it. This has been used to intercept traffic and to redirect cryptocurrency services, and it also happens accidentally through misconfiguration.
Route leaks. A network passes along routes it should not have — typically announcing its transit provider's routes to a peer — and suddenly finds itself carrying vastly more traffic than it can handle. A notable incident occurred when a single ISP's leak degraded connectivity for large parts of the internet.
Withdrawal. If a network stops announcing its own routes, it disappears entirely. A major outage in 2021 happened essentially this way — a configuration change withdrew a company's routes, making its services unreachable worldwide, and also disabled the internal tools needed to fix it.
What is being done about it:
RPKI (Resource Public Key Infrastructure), which cryptographically certifies which network is authorised to announce which address block, allowing invalid announcements to be filtered. Adoption has grown substantially but is not universal.
Route filtering and maximum prefix limits at network boundaries.
MANRS, an industry initiative setting baseline routing security norms.
Monitoring services that alert operators when their prefixes are announced by someone else.
BGP is still not authenticated end to end, which remains a structural weakness of the internet.