⚠️ BGP Route Leaks Explained

🔍 What Is a BGP Route Leak?

A route leak occurs when a network (often unintentionally) advertises routes it learned from one BGP neighbor to a different neighbor in a way that violates the intended, agreed-upon scope of that routing relationship. The canonical example: a network that buys transit from two different providers (Provider A and Provider B) accidentally advertises the full set of routes it learned from Provider A back out to Provider B — effectively offering itself as free, unintended transit between two large networks that never agreed to route through it.

This matters because BGP, by design, largely trusts what neighboring networks tell it. There's no protocol-level mechanism inherently preventing a network from re-advertising routes it shouldn't; enforcing that boundary is left entirely to each network's own configured routing policy (export and import filters). A single missing or misconfigured filter, applied to a router carrying even a modest fraction of the internet's routes, can have an outsized ripple effect across the wider internet.

It's important to distinguish route leaks from BGP hijacks. A hijack involves a network announcing itself as the origin for address space it doesn't own or control — essentially claiming ownership of someone else's prefixes. A leak involves correctly-attributed routes (the origin AS information is accurate) being propagated to the wrong audience, violating the intended peer/customer/transit routing hierarchy without necessarily misrepresenting who owns what. Both can cause similar real-world symptoms — traffic taking an unexpected, often much longer or congested path, or an outage — but the root causes and appropriate technical fixes differ.

The Internet Engineering Task Force formally categorizes several distinct types of route leaks in RFC 7908, including leaks from a customer to a provider (the most common pattern), leaks between a network's own peers, and leaks involving more complex multi-hop scenarios — useful vocabulary for precisely describing and diagnosing a specific incident after the fact.

🎯 Why Route Leaks Matter

Route leaks have caused some of the most significant, widely publicized internet routing incidents in recent history, at times affecting major cloud providers, content platforms, and even entire countries' connectivity for extended periods. Understanding them isn't an academic exercise — it's directly relevant to any network's operational risk profile.

The impact of a route leak typically manifests in one of two ways. First, congestion and outages: the network that accidentally becomes unintended transit is rarely provisioned to carry that volume of traffic, leading to severe congestion, packet loss, or complete overload on the leaking network's own infrastructure, which can cause outages for the leaking network's legitimate customers as well as everyone whose traffic got misrouted through it. Second, traffic interception risk: even when a leak doesn't cause an outright outage, rerouting traffic through an unintended path can expose that traffic to interception or inspection by a network that was never meant to see it — a real security and privacy concern, particularly for sensitive or international traffic.

Route leaks also carry significant reputational and business cost for the networks involved. High-profile leak incidents are widely reported in the technical press, and the affected networks often face customer trust and relationship consequences well beyond the technical remediation itself — providing strong business justification for investing in the (relatively inexpensive) preventive practices covered later in this guide.

Finally, route leaks illustrate a broader truth about internet routing: the overall stability of the global routing system depends heavily on each individual network operator implementing sound routing policy, since BGP's trust model assumes good-faith, correctly-configured participants. This makes route leak prevention a genuinely collective responsibility — initiatives like MANRS exist specifically to formalize and encourage this shared baseline of good practice across the industry.

The regulatory and public-interest dimension of route leaks has also grown over time, as national and international bodies increasingly recognize internet routing security as critical infrastructure policy, not purely a private technical matter between network operators. This has contributed to growing adoption of frameworks like MANRS and increasing expectations, in some markets, that significant network operators demonstrate baseline routing security practices as part of broader infrastructure resilience requirements.

⚙️ How Route Leaks Typically Happen

🏗️ Architecture: Where Leaks Originate

Route leaks fundamentally stem from a mismatch between a network's intended routing policy (which routes should go to which neighbors) and its actual configured policy on its routers. The technical mechanisms that should prevent leaks — export filters based on BGP communities that tag route origin (customer/peer/transit) — are well understood and widely documented, but implementing them correctly and consistently across every router and every session is a genuine operational challenge, especially at scale or during network changes.

A particularly common architectural risk factor is route reflector or router misconfiguration during network changes — a router intended to be a purely internal route reflector, or a router being reconfigured for a new peering relationship, accidentally gets a default "advertise everything" policy applied instead of the correct scoped policy, especially if configuration templates aren't rigorously version-controlled and reviewed before deployment.

Address more specific prefixes deserve particular attention in leak scenarios: because BGP's best path selection strongly prefers a more specific prefix over a broader aggregate covering the same address space, a leaked route that happens to be more specific than the legitimate announcement can attract disproportionate traffic almost instantly, even if the leaking network's overall capacity to carry that traffic is far smaller than what suddenly gets routed to it.

🔧 Step-by-Step: Preventing Route Leaks

💡 Practical Examples & Notable Incidents

A well-documented pattern involves a smaller regional network, multi-homed to a major international transit provider and a large domestic backbone network, accidentally re-advertising the international provider's full routing table to the domestic backbone. Because the domestic backbone's import filters weren't sufficiently strict, it accepted and began preferring these routes over its own legitimate paths for a significant portion of the internet, causing widespread regional slowdowns until the leak was identified and withdrawn.

Several major, publicly reported incidents over the years have involved a network operator's router accidentally announcing a large portion of the global routing table — sometimes hundreds of thousands of prefixes — to a single upstream provider due to a configuration error during maintenance, causing significant traffic disruption for major cloud and content platforms whose traffic transited the affected paths, until providers along the chain implemented emergency filtering to contain the leak.

A more localized example: a university network's border router, misconfigured after a hardware replacement, briefly re-advertised a research network's routes to its commercial transit provider, causing a portion of unrelated commercial traffic to briefly route through the university's much smaller-capacity link before automated maximum-prefix limits on the transit provider's side tore down the session and contained the impact.

✅ Implementation Checklist

Use this checklist to audit your own network's route leak risk and preventive controls.

📚 Key Terms Glossary

🔗 Related Tools

❓ FAQs