How Internet Routing Security Actually Works

A Deep Dive into BGP, RPKI, Routing Attacks and Global Internet Defense

Introduction: Why Routing Security Is Harder Than It Looks

Chapter 1: The Architecture of Global Connectivity

1. IP Addressing and the Prefix Hierarchy
2. Autonomous Systems and Administrative Boundaries
3. The Transit-Peering Model and Its Economics
4. Delegation: How Addresses and ASNs Become Someone’s Responsibility
5. Scalability Through Hierarchical Aggregation

Chapter 2: Interdomain Routing Fundamentals

1. What Interdomain Routing Must Achieve
2. Direct Connectivity: iBGP and eBGP Sessions
3. Route Advertisements and Withdrawals in Practice
4. Import and Export Policies: The Operator’s Control Point
5. Propagation Through the Transit Web

Chapter 3: BGP Protocol Architecture

1. The BGP Message Types: OPEN, UPDATE, NOTIFICATION, KEEPALIVE
2. The BGP Finite State Machine: From Idle to Established
3. TCP Port 179 and Transport Considerations
4. BGP-4 UPDATE Message Structure and TLV Encoding
5. Capabilities Negotiation and Modern Extensions

Chapter 4: BGP Path Attributes and Policy Expression

1. Well-Known Mandatory, Well-Known Discretionary, Optional Transitive, Optional Non-Transitive
2. AS_PATH: Loop Detection and Policy Signal
3. NEXT_HOP, LOCAL_PREF, MED and ORIGIN: Comparative Selection Logic
4. BGP Communities and Extended Communities: Encoding Policy at Scale
5. ADD-PATH, TTL Security Mechanisms (GTSM) and Other Modern Attributes

Chapter 5: The BGP Decision Process and Route Selection

1. The Step-by-Step BGP Decision Process
2. Weight, LOCAL_PREF and Administrative Distance
3. AS_PATH Length, ORIGIN and MED Comparisons
4. Route Preference and IGP Influence: eBGP vs iBGP vs Static vs IGP
5. Multi-Exit Discrimination, Tie-Breakers and Stability

Chapter 6: Convergence, Stability and Propagation Dynamics

1. Convergence Time and Global Propagation Delays
2. Route Flapping and Dampening (RFC 2439)
3. Hot Potato Routing and Path Instability
4. Slow Convergence as an Attack Surface
5. Measurement Data on Convergence Behavior

Chapter 7: Historical Design Decisions and Their Security Consequences

1. EGP, CGE and the Origins of Interdomain Routing Protocols
2. The Scalability Imperative: Why End-to-End Verification Was Abandoned
3. The Trust Assumptions Embedded in BGP-4’s Design
4. Operational Flexibility Over Consistency: A Deliberate Choice
5. Why Security Was Added as an Afterthought

Chapter 8: The Threat Landscape: Accidents and Intentional Attacks

1. Accidental Misconfiguration: The Most Common Disruption
2. Origin Prefix Hijacking and Impersonation
3. Route Leaks: Transit Rules Violated
4. Subprefix Hijacking and Splitting
5. Blackholing and Traffic Interception
6. AS_PATH Manipulation and Policy Exploitation
7. Control-Plane Exhaustion and Volumetric Attacks
8. Compromised Routers and Network Operators

Chapter 9: Origin Hijacking Attacks: Mechanics, Impact and Detection

1. Attack Prerequisites and Execution Steps
2. Complete vs. Partial Hijacking
3. Confidentiality and Integrity Implications
4. How Hijacking Enables Phishing and MITM
5. Detection via Route Monitors, Looking Glasses and Real-Time Alerts
6. The Role of RPKI and ROV in Origin Hijacking Prevention

Chapter 10: Route Leaks and Policy Abuse

1. What Is a Route Leak and How It Differs From Hijacking
2. The Customer-Concentrator-Provider Leak Pattern
3. Accidental vs. Intentional Policy Violations
4. Propagation Patterns and Impact on Reachability
5. Prevention Through Policy, Filtering and Community Tags
6. Detection via Monitoring and Analysis

Chapter 11: Advanced and Emerging Routing Threats

1. Compromised Routers and Rogue Operators
2. Competitive Manipulation: Steering Traffic for Advantage
3. Attacks on Route Collectors and Validation Infrastructure
4. Long-Term Reconnaissance and Persistent Manipulation
5. Threats Specific to Large Networks and Cloud Providers

Chapter 12: The Routing Registries: IRRs and Their Limitations

1. What Routing Registries Are and How They Store Route Objects
2. Creating Route Objects: Route, Route6, AS-SET and Related Classes
3. Policy-Based Filtering: Using IRR Data to Build Filters
4. Weaknesses: No Authorization Checking, No Cryptographic Binding
5. The Transition from IRR Filtering to RPKI-Based Validation

Chapter 13: The RPKI Architecture: Resource Certificates and Trust Anchors

1. The RPKI Trust Model: Hierarchical Certification from RIRs
2. Trust Anchors and Root Certificates at Each RIR
3. Resource Certificates: Structure, Extensions and Resource Holders
4. CA Certificates and Chain Validation
5. Manifests and Signed Object Lists: What They Protect

Chapter 14: Route Origin Authorizations: The Core Authorization Object

1. What a ROA Is and What It Proves
2. Creating a ROA: Prefix, AS Number and Maximum Length
3. Max-Length: How It Controls Subprefix Authorization
4. ROA Lifespan, Expiration and Revocation
5. Common Mistakes: Over-Permissive, Under-Covered and Conflicting ROAs

Chapter 15: RPKI Validation: Validators, VRPs and Relying Parties

1. What an RPKI Validator Does: Download, Verify, Extract
2. Validator Architecture and Repository Sync (rsync, HTTPS)
3. Validated ROA Payloads (VRPs): The Validator’s Output
4. CRL and SKI/IAI: Revocation and Validation Accuracy
5. Validator Outages, Stale Data and Recovery Behavior

Chapter 16: RPKI-to-Router (RTR) and Route Origin Validation (ROV)

1. The RPKI-to-Router Protocol: Serial-Notify, Serial Query, Cached Data, Reset
2. Session Establishment, Keepalive and Data Transfer
3. How VRPs Become Route Decision Criteria
4. ROV Integration with the BGP Decision Process
5. Handling State Transitions: Valid, Invalid, NotFound and Pending

Chapter 17: Operational Consequences of ROV: Invalid, Valid, NotFound and Real-World Effects

1. Rejecting Invalid Routes vs. De-Prioritizing Them
2. The Risk of Rejecting Legitimate Traffic
3. NotFound: The Ambiguous Middle State
4. Max-Length Policy Errors and Collateral Damage
5. Documented Incidents: When ROV Went Wrong

Chapter 18: The Scope and Limits of RPKI and ROV

1. What Origin Validation Proves and What It Does Not
2. Why RPKI Cannot Prevent All Route Leaks
3. The Dependency on Accurate, Complete ROA Data
4. Cryptographic Soundness vs. Operational Fragility
5. Misconceptions About What RPKI “Solves”

Chapter 19: Complementary Mechanisms: IRR Filtering, Prefix Filters and AS_PATH Filters

1. Prefix Filters: What Prefixes Should Be Announced
2. AS_PATH Filters: Detecting and Rejecting Suspicious Paths
3. IRR-Based Filtering: Still Relevant After RPKI
4. Maximum-Prefix Limits: Protection Against Table Poisoning
5. BGP Communities for Policy Signaling and Leak Prevention

Chapter 20: Route Leak Detection and Prevention Mechanisms

1. Community-Based Leak Prevention
2. Automated Leak Detection via Route Collectors and Monitors
3. BGPsec Route Leak Prevention Potential
4. MANRS Principles and Their Implementation Status
5. Coordination and Incident Response When Leaks Occur

Chapter 21: BGPsec: Architecture, Security Guarantees and Deployment Reality

1. BGPsec’s Threat Model: Protecting AS_PATH Integrity
2. The BGPsec Path Attribute and Signature Chain
3. Key Management and Certificate Infrastructure
4. Operational Barriers: Complexity, Interoperability and Performance
5. Current Deployment Status and Future Prospects

Chapter 22: ASPA: Autonomous System Provider Authorizations

1. What ASPA Is and the Problem It Solves
2. ASPA Structure: Customer, Provider and Peer Relationships
3. Integration with the RPKI Trust Infrastructure
4. How ASPA Validation Affects Route Selection
5. Current Deployment Status and Standardization Progress

Chapter 23: Designing and Implementing Routing Security in Your Network

1. Step 1: Inventory and Audit Your Address Space and Announcements
2. Step 2: Verify Ownership and Create or Update ROAs
3. Step 3: Design and Deploy Import Filters
4. Step 4: Design and Deploy Export Filters
5. Step 5: Enable ROV with Staged Enforcement
6. Step 6: Implement Monitoring, Logging and Alerting
7. Step 7: Document Policies, Plan Rollback and Test Recovery

Chapter 24: Configuration Examples and Vendor-Specific Considerations

1. Cisco IOS XR: ROV, Filtering and RTR Configuration
2. Juniper Junos: ROV, Filtering and RPKI Integration
3. Nokia SR OS: Routing Security Configuration
4. Open Source and Research Platforms: FRR, ExaBGP and BIRD
5. Common Pitfalls Across Platforms

Chapter 25: Troubleshooting Routing Security Controls

1. Unexpected Invalid Routes: Systematic Diagnosis
2. RTR Session Failures and Stale Validation Data
3. ROA Lookup: Verifying What Validators See
4. Legitimate Routes Rejected by Filters
5. Cross-Validator Consistency Checks
6. Post-Incident Forensics: Reconstructing What Happened

Chapter 26: Monitoring, Measurement and Testing

1. Real-Time Route Monitoring: BGPStream, RIS-Live and RouteViews
2. Looking Glasses and Prefix Monitoring Services
3. Safe Testing: Lab Environments and Controlled Announcements
4. Public Incident Detection Systems and Alerts
5. Metrics That Matter: Convergence, Stability and Coverage

Chapter 27: Case Studies: Documented Routing Incidents

1. Pakistan Telecom YouTube Hijack (February 24, 2008)
2. Safe Host / China Telecom Route Leak (June 6, 2019)
3. Cloudflare 1.1.1.1 Incident (June 27, 2024)
4. 3ve BGP Hijacking Campaign (2018)
5. Comparative Analysis: What Changed, What Remained Vulnerable

Chapter 28: Economics, Governance and the Human Dimension

1. Who Is Responsible for What: A Stakeholder Map
2. Economic Incentives and Disincentives for Adoption
3. The Role of RIRs, Regional Communities and IETF
4. MANRS, IRTF and Industry Self-Regulation
5. Why Technically Sound Mechanisms Fail to Deploy

Chapter 29: The Current State and Future of Internet Routing Security

1. The Baseline: How Secure Is Global Routing Today?
2. Deployment Gaps: Who Has Not Adopted and Why?
3. Open Research Problems and Protocol-Level Unknowns
4. Plausible Developments: ASPA, BGPsec Revival, or New Directions?
5. A Grounded Assessment: Progress Made, Work Remaining

Conclusion

References