BGP ORIGIN attribute manipulation and its impact on the Internet
Key Points
- ~70% of observed paths show ORIGIN mismatch
- ORIGIN is an early BGP tie‑breaker (lower preferred)
- RFC4271: ORIGIN should not be modified
Summary
The post investigates manipulation of the BGP ORIGIN attribute and shows it is frequently altered in transit. ORIGIN (IGP=0, EGP=1, INCOMPLETE=2) is evaluated early in BGP's tie‑breaker (after Local Preference and AS_PATH length), with lower values preferred. Cloudflare’s experiments observed that ~70% of paths from multiple vantage points had an ORIGIN value different from what the originating AS set. Public collectors show 89.8% of routes as IGP, 3.5% EGP, and 6.7% INCOMPLETE. RFC4271 states ORIGIN should be set by the origin and not modified by others, but operational behavior deviates in practice.
Key Points
- ORIGIN indicates how a route was injected (IGP/EGP/INCOMPLETE); it is distinct from origin AS.
- ORIGIN is evaluated early in the BGP path selection process and can change route selection when other attributes tie.
- Experiments found ~70% of observed paths had an ORIGIN value different from the origin AS’s setting.
- Global collectors report ~89.8% IGP, 3.5% EGP, 6.7% INCOMPLETE across observable routes.
- RFC4271 advises against modifying ORIGIN, but many routers or interconnection policies alter it in practice.
Practical recommendations for engineers
- Monitor ORIGIN consistency for your prefixes using public collectors (RIPE RIS, RouteViews) and your own peers.
- Add ORIGIN checks to BGP monitoring/alerting pipelines to detect unexpected changes or patterns.
- Use prefix and peer filtering, max‑prefix limits, and clear export policies to reduce attribute tampering.
- Apply Local Preference or other policy controls where you need to enforce path selection despite ORIGIN differences.
- Deploy RPKI/ROV and other origin validation tools to improve routing security and detect anomalous injections.
- Coordinate with upstream providers and peers to trace and remediate ORIGIN mismatches when detected.
Why it matters
Because ORIGIN is an early tie‑breaker, widespread manipulation can meaningfully alter traffic flows and routing stability. Engineers should treat unexpected ORIGIN changes as operational or security signals and incorporate detection and mitigation into BGP hygiene processes.