The return of EGP or the curious case of the BGP Origin attribute#

Wolfgang Tremmel (DE-CIX Academy)

• Why: A fascinating BGP protocol internals investigation — who is setting the Origin attribute to "e" (EGP) in the global routing table, and why. Includes the discovery that Tier1 providers are rewriting Origin to win best-path selection. Directly relevant to the PM's BGP/datapath internals interest.
• What: While preparing BGP training slides, Tremmel found 868 prefixes with Origin "e" (EGP) — a value that should theoretically never appear since EGP is dead. Investigation shows 118 ASes (IPv4) and 19 ASes (IPv6) originating EGP-tagged prefixes, with Google (AS396982: 348 IPv4 prefixes, AS394089: 83) as the largest contributor. The key insight: Tier1 providers are rewriting Origin-Type to "IGP" to win traffic in multi-transit scenarios where LocalPref and AS-path length tie.
• How: BGP best-path selection step 4 prefers IGP over EGP over Incomplete origin. If a customer sets equal LocalPref for multiple transits and receives same-length AS paths, the transit that rewrites Origin to "IGP" gets more traffic. No BGP implementation can turn off Origin evaluation. Countermeasure: rewrite Origin-Type for all incoming prefixes yourself (but consult BGP customers first).
• Where applicable: Any network operator with multiple transit providers and no BGP customers. The finding about Google AS396982/394089 originating EGP-tagged prefixes is unusual and unexplained. This is a global routing-table observation (from DE-CIX route collectors), applicable to any operator doing BGP traffic engineering with multiple upstreams.