Cloudflare study finds widespread BGP ORIGIN rewriting can steer Internet traffic

Cloudflare researchers say a long-standing but often overlooked Border Gateway Protocol behavior is shaping how traffic moves across the Internet. In a July 24 analysis, the company reported that many network operators appear to rewrite the BGP ORIGIN attribute, a route attribute that is supposed to describe how a route was introduced into BGP and should generally be preserved after the originating autonomous system sets it.

The finding matters because BGP remains the core routing system that tells networks how to reach each other. When multiple paths look otherwise comparable, ORIGIN can influence which route a router selects. Cloudflare argues that rewriting it to a more preferred value can push traffic toward one transit provider instead of another, creating a routing advantage that may have business value even when there is no technical need for the change.

What Cloudflare Tested

Cloudflare said it announced IPv4 and IPv6 prefixes from its own network with different ORIGIN values, then examined routing updates collected from public BGP collectors and its own border-router data. The company focused first on direct peers, where attribution is clearer, and then expanded its analysis to longer paths using an inference method that tried to separate networks preserving ORIGIN from networks modifying it.

The headline result was striking: Cloudflare said roughly 70% of observed IPv4 paths and 67% of observed IPv6 paths in its experiment had ORIGIN reset to IGP. It also said about 10% of attributed visible autonomous systems changed ORIGIN to IGP, with the behavior concentrated among large, central networks. Among top-ranked networks, Cloudflare reported manipulation by 26% of the top 50 autonomous systems and 20% of the top 100.

Why Operators Should Care

This is not a consumer-facing outage story, but it is a consequential infrastructure story. Cloudflare says the practice can redirect traffic toward major transit providers and away from alternatives that preserve the attribute. In its simulated converged routing-table analysis, ORIGIN rewriting gave rewriters additional paths that would otherwise have gone through networks leaving the value unchanged.

Cloudflare is now calling for the networking community and the IETF to revisit whether ORIGIN should continue influencing BGP path selection. The company says immediate removal is not practical because ORIGIN is mandatory in BGP, but it supports reducing the attribute's role or standardizing behavior so compliant networks are not disadvantaged by those rewriting routes for preference.

The broader lesson is that Internet routing security and fairness are not only about hijacks and outages. Small route-selection details, especially when adopted by influential networks, can quietly alter global traffic flows. Cloudflare's research gives operators fresh data for a debate that has been discussed in routing circles but rarely quantified at this scale.

Sources

• blog.cloudflare.com

Cover photo by Brett Sayles on Pexels, used under the Pexels License.