70% of BGP paths show manipulated ORIGIN attribute

The Border Gateway Protocol (BGP), which governs how data travels across the internet, relies on path attributes to determine optimal routes. One such attribute, ORIGIN, is intended to remain unchanged after being set by the originating network. However, a recent analysis by Cloudflare reveals that this rule is routinely ignored, with significant consequences for internet routing behavior.

How ORIGIN manipulation works

The ORIGIN attribute signals how a route entered BGP, with three possible values: IGP (interior to the originating network), EGP (a legacy protocol no longer in use), and INCOMPLETE (learned from an external source). According to BGP standards, this value should not be modified by any network after the initial announcement. Yet Cloudflare’s experiment found that nearly 70% of observed paths had their ORIGIN values altered, often by transit providers seeking to influence traffic flow.

The manipulation typically involves rewriting the ORIGIN to IGP, the most preferred value in BGP’s path selection algorithm. When two routes have equal local preference and AS_PATH length, the route with the lower ORIGIN value (IGP < EGP < INCOMPLETE) is selected. By changing ORIGIN to IGP, networks can make their routes more attractive, diverting traffic—and revenue—away from competitors. Cloudflare’s data shows that 10% of direct peers and 26% of the top 50 networks by customer cone size engage in this practice, with Tier-1 providers among the most active rewriters.

Impact on internet routing

The widespread rewriting of ORIGIN has tangible effects on path selection. In Cloudflare’s experiment, altering the attribute to IGP secured additional paths for rewriting networks in 18% of IPv4 cases and 40% of IPv6 cases. Some of these paths bypassed Tier-1 networks entirely in the control group, demonstrating how manipulation can reshape traffic flows. The practice is particularly prevalent among large providers, with 20% of the top 100 networks by customer cone size modifying ORIGIN values.

The inconsistency in ORIGIN handling creates an uneven playing field. Networks that comply with BGP standards risk losing traffic to those that rewrite the attribute, incentivizing further manipulation. This dynamic has led to calls for deprecating ORIGIN entirely, as its role in path selection is now overshadowed by its use as a tool for traffic engineering. Cloudflare’s findings align with earlier research presented at RIPE 91 and LACNIC 45, which first highlighted the scale of ORIGIN rewriting among major networks.

Proposals for change

Cloudflare argues that ORIGIN no longer serves a meaningful purpose in modern internet routing. The company suggests that BGP implementations should default to setting ORIGIN as IGP for all routes, effectively neutralizing its influence. This approach would align with the current reality, where IGP is already the dominant value for 89.8% of routes. Alternatively, reviving the expired IETF draft "Scrubbing BGP ORIGIN Attribute" could provide a formal path to deprecation.

The study underscores the tension between BGP’s technical design and the commercial realities of internet routing. While manipulation may offer short-term advantages, it erodes trust in the protocol’s integrity and complicates efforts to standardize routing behavior. Without intervention, the practice is likely to persist, further entrenching ORIGIN as a tool for competitive advantage rather than a stable routing signal.