Autonomous Systems and BGP: How the Internet Routes Between Networks

An autonomous system is a network under one administrative authority with a single, consistent routing policy, identified by a globally unique AS number. The internet is roughly a hundred thousand of them exchanging reachability information, and BGP is the protocol they use to do it.

Interior and exterior routing

The distinction organizes the whole topic.

Interior gateway protocols — OSPF, IS-IS, EIGRP, RIP — run inside one autonomous system. Their job is to find the best path by a technical metric such as cost or hop count, and they converge quickly because everyone inside the AS is cooperating.

Exterior gateway protocols — BGP in practice — run between autonomous systems. Their job is to enforce policy, not to find the technically shortest path. A network may prefer a longer route because it is cheaper, or refuse to carry traffic between two neighbours because it has no contract to do so.

That is why BGP is described as a path vector protocol rather than a distance vector one: it advertises the full AS path a route traverses, and the path is used for loop prevention — an AS that sees its own number in a path rejects the advertisement — and as an input to policy.

The loop prevention mechanism is worth contrasting with the interior approach, where distance vector protocols rely on split horizon and hold-down timers to avoid believing stale news. BGP simply carries the history with the route.

eBGP, iBGP and AS numbers

eBGP runs between routers in different autonomous systems, typically directly connected. iBGP runs between routers within the same AS to distribute externally learned routes internally — and it requires a full mesh of sessions or route reflectors, because iBGP does not re-advertise routes learned from another iBGP peer.

AS numbers were originally 16-bit and are now 32-bit, allocated by the regional internet registries. Ranges are reserved for private use, which is how an organization runs BGP with a provider without holding a public number.

Transit, peering and the money

Commercial relationships determine routing policy, and the vocabulary appears on exams.

Transit is a paid relationship: a customer pays a provider to carry its traffic to the rest of the internet. The provider advertises the customer's routes to everyone.

Peering is an exchange between two networks to carry traffic destined for each other and their customers only, usually settlement-free because the benefit is mutual. It is not transit — a peer does not carry your traffic onward to third parties.

That distinction is why the valley-free rule exists: a network accepts routes and forwards traffic in patterns that match who is paying whom, and never provides free transit between two peers.

Multihoming — connecting to more than one provider — requires your own AS number and address space, and is how an organization achieves provider-independent redundancy. Note that BGP chooses between providers by policy rather than by measured link quality, which is the gap SD-WAN fills at the branch. It also means running BGP yourself, which is a real operational commitment.

Why BGP security is hard

BGP was designed among cooperating operators and has no built-in verification that an advertisement is legitimate. A network announcing a prefix is generally believed.

Prefix hijacking follows: an AS announces address space it does not hold, and traffic destined for that space arrives at it instead. Announcing a more specific prefix wins over a less specific one regardless of path, which makes the attack effective. It has been used to intercept traffic and to redirect cryptocurrency and certificate validation traffic, and it also happens by accident through configuration error — the accidental cases are more common and look identical at first.

Route leaks are the policy version: a network advertises routes it should not, typically announcing a peer's routes to a provider, and briefly becomes transit for traffic it cannot carry.

The mitigations are filtering and cryptographic origin validation. Operators filter what they accept from customers against registry data, apply maximum prefix limits so a mistake does not propagate, and increasingly validate route origins against signed records so an announcement from an unauthorized AS is rejected. Adoption has grown substantially and is not universal, so the attack remains viable in parts of the internet.

Note also that BGP is what makes upstream DDoS mitigation work — announcing a prefix from a scrubbing provider reroutes traffic globally within minutes, and black-holing is a BGP announcement too.

Exam angles

Define an autonomous system as a network under single administrative control with a unique AS number. Distinguish interior gateway protocols (within an AS, metric-based) from BGP as the exterior protocol (between AS, policy-based, path vector). Know eBGP versus iBGP, transit versus peering, and AS path as both loop prevention and a policy attribute. Recognize prefix hijacking and route leaks as the consequence of BGP's implicit trust, with filtering and route origin validation as the controls.