Knowledge / network detection

BGP

Border Gateway Protocol. How networks exchange routes. A hijack shows up as an unexpected origin ASN or RPKI invalid.

BGP is the routing protocol between autonomous systems. Operators announce prefixes they originate; neighbours propagate them. The path is a list of ASNs. There is no built-in proof the prefix is yours unless you add filtering, IRR, or RPKI origin validation.

To an analyst, a route hijack is an announcement that should not exist: unexpected origin ASN for a prefix, a more-specific covering a victim, or RPKI invalid. Traffic goes somewhere else. Users see the wrong site or a black hole. Detect it in routing telemetry, not folklore. This page is not a hijack method.

See also: CIDR, DNS, Threat intelligence.

Fact source: IETF RFC 4271, BGP-4.