A new Cloudflare study uncovers a pervasive practice in BGP routing: transit providers rewriting the ORIGIN attribute to gain traffic advantages. By analyzing real-world BGP data, Cloudflare found that nearly 70% of BGP paths experience ORIGIN attribute modifications, which can divert traffic, increase latency, and erode the trustworthiness of routing information.
Key findings and technical details:
- The BGP ORIGIN attribute is meant to indicate where a route originated, but transit providers frequently alter it, often using
local-preforMED(multi-exit discriminator) to influence path selection. - Cloudflare built a custom testbed using RIPE Atlas probes and their own infrastructure to detect rewrites, discovering that these modifications can shift traffic towards specific providers, creating potential for hijacks or blackholing.
- The study argues that the ORIGIN attribute is unreliable and should be deprecated from route selection algorithms, favoring AS_PATH and other metrics already used in
bgp bestpathdecisions. - Concrete impact: up to 30% increase in latency for affected routes, and increased vulnerability to prefix hijacks because ORIGIN can be spoofed or overwritten without detection.
For developers, this means that any tool or service relying on BGP for traffic engineering, anycast routing, or network monitoring must be aware that ORIGIN is not trustworthy. If you run your own network, consider configuring bgp bestpath compare-routerid and ignoring ORIGIN for path selection. Cloudflare's findings also highlight the importance of RPKI and BGPsec to authenticate route origin, as ORIGI alone cannot be trusted.