The return of EGP or the curious case of the BGP Origin attribute#

Wolfgang Tremmel (DE-CIX Academy)

• Why: A BGP protocol-internals investigation with a genuinely surprising finding: Tier1 providers are rewriting Origin-Type to win traffic in multi-transit tie-breaks. This affects anyone with multiple upstreams and equal LocalPref — a subtle traffic-engineering dynamic that most operators don't know is happening.
• What: While preparing BGP training, Tremmel found 868 prefixes in the global routing table with Origin "e" (EGP) — a value that should never legitimately appear since EGP is dead. Investigation shows 118 ASes (IPv4) and 19 (IPv6) originating EGP-tagged prefixes, with AS396982 (Google) accounting for 348 IPv4 prefixes. The key insight: Origin-Type (best-path selection step 4, after LocalPref and AS-path length) is being weaponized by transit providers who rewrite it to "IGP" to attract more traffic when customers set equal LocalPref across multiple transits.
• How: When LocalPref and AS-path length tie between two transits, the one that rewrites Origin to "IGP" (preferred over "e" and "incomplete") wins the tie-break. No BGP implementation can turn off Origin evaluation. Countermeasure for networks with multiple transits and no BGP customers: rewrite Origin-Type uniformly for all incoming prefixes; for those with BGP customers, consult them first.
• Where applicable: Any network operator with multiple transit providers. The observation comes from DE-CIX's route collectors and a RIPE91 presentation by James Bensly (inter.link) — globally applicable to multi-homed networks. The Google EGP-tagged prefixes (AS396982, AS394089) remain unexplained.