Quick answer
BGP (Border Gateway Protocol) is how the internet's independent networks tell each other which blocks of IP addresses they can deliver traffic to. Each network — an autonomous system, identified by an AS number — announces its own address ranges to its neighbours, who pass those announcements on. There is no central authority deciding routes; the map assembles itself from what everyone claims. That design is what makes the internet resilient, and also why announcements are believed largely on trust.
How routing decisions get made
An autonomous system is a network under one administrative control — an ISP, a hosting provider, a large company. Each has an AS number, and each announces to its neighbours: these address ranges are reachable through me.
Neighbours pass the announcement along, adding their own AS number to the path. A router receiving several routes to the same destination generally prefers the one with the shortest AS path, adjusted by local policy and commercial agreements. Nobody has the whole picture; every router makes a local decision from what it has been told.
AS 64500 announces 203.0.113.0/24
neighbour AS 64501 hears: 203.0.113.0/24 path: 64500
then AS 64502 hears: 203.0.113.0/24 path: 64501 64500
then AS 64503 hears: 203.0.113.0/24 path: 64502 64501 64500
shorter path usually wins — but policy can override itBuilt on trust, and the consequences
BGP has no built-in way to verify that a network is entitled to announce a prefix. If an operator announces someone else's addresses, neighbours will generally accept it and traffic will follow — this is a BGP hijack, and it has happened repeatedly, sometimes by mistake and sometimes not.
A more specific announcement wins over a less specific one, which makes hijacks effective: announcing a /24 out of someone's /16 pulls that traffic to you regardless of what the legitimate holder is doing.
- RPKI lets a prefix holder cryptographically state which AS may announce it
- IRR databases record intended routing policy for filtering
- Prefix filtering between neighbours catches obviously wrong announcements
- Adoption is partial, so the internet still runs substantially on trust
Why it matters for DDoS protection
Routing is how packet-level protection is delivered. If a provider announces your prefix, all traffic for those addresses arrives at their network first — that is the mechanism by which scrubbing becomes possible at all.
It also underpins anycast: the same prefix announced from many locations, so each visitor reaches whichever instance is nearest, and an attack is divided by the same routing that divides real traffic.
And it is behind the least pleasant word in the industry: null-routing. When a provider decides an attack is not worth absorbing, they can announce your address into a blackhole, discarding the flood — and your legitimate traffic with it.
| Term | What it means for you |
|---|---|
| BYOIP | You own the prefix; the provider announces it on your behalf |
| Anycast | One prefix from many locations, so attacks spread automatically |
| Null route | Your address announced to a blackhole — the flood stops, so does your service |
| Route leak | An announcement escaping past its intended scope, sending traffic the wrong way |
AS numbers as a signal
Because every address block belongs to an announced prefix, you can map any IP address to the AS that announced it. That is more informative than the address alone: it tells you whether a visitor is on a residential ISP, a hosting provider, a cloud platform or a known crawler's own network.
It is how crawler verification works without expensive DNS lookups — a request claiming to be Googlebot from an AS that is not Google's is not Googlebot. It is also why blanket-blocking a whole AS is a blunt instrument: hosting ASNs carry legitimate API traffic as well as automation.
Frequently asked questions
Last updated