BGP & How the Internet Routes
No router knows the internet, yet packets cross it: announcements, withdrawals, the longest-prefix rule and the hijack it allows.
An interactive Networking lesson: 20 steps, about 35 minutes, on a live simulation in your browser.
The shop's network is 10.0.2.0/24, served by hostB behind the router r2. Its autonomous system, AS64500, tells the rest of the internet one fact: this prefix lives behind us. That statement is a route announcement.
Nobody sends r1 a map of the internet. r1 holds one route for the shop's prefix pointing at r2, the way your own router holds routes someone typed or a protocol learned. hostA pings hostB across it.
What you will learn
Routers must be told
- One shop, one prefix
- Announcements, not maps: BGP routers exchange announcements, prefix plus next hop, not maps. Each router picks its own best and passes it on.
Watch a reconvergence
- The short path, working
- Withdraw the route: A withdrawal is an announcement in reverse: forget this prefix. Until a better route arrives, the packets stop.
- Traffic moves to r3: Failover is nothing more than different table entries. Routing protocols exist to make those edits for you.
- The routers agree: Convergence is every router independently picking the same new best. The packets only move once the tables agree.
Longest prefix always wins
- Which announcement wins?: Longest prefix wins before anything BGP compares. A /32 beats a /24 the way a street address beats a city.
- The day YouTube vanished: Longest prefix always wins, everywhere, even when the announcement is a lie.
- Who is hurt by a leak?
Inside one AS
- eBGP speaks between, iBGP within: eBGP between autonomous systems, with suspicion. iBGP inside one, with trust. Filter at the borders.
- Break it: withdraw the way back: A route covers one direction only. Two hosts can talk when there is a working route there and a working route back.
- Drill: show the BGP table
- Everyone inside hears everything: iBGP needs a full mesh or reflectors: a router that never heard an announcement cannot use it.
Filtering the lies
- Break it: a more-specific to nowhere: A more-specific to nowhere beats a correct /24. That is the whole hijack, and it fits in one table row.
- Back to the real route: Rejecting a bad announcement is deleting a row. Everything after this chapter is deciding which rows to refuse.
- Filters: believe your customer a little: Accept only the prefixes your neighbour is allowed to announce. Everything else is dropped at the door.
- Drill: write the filter line
- RPKI: permission you can check: RPKI is a signed permission slip: this AS may announce this prefix. Routers drop announcements that fail the check.
Recap & playground
- Cheat sheet
- Playground