BGP ORIGIN in Practice: Inconsistencies Observed in LACNIC Prefixes#

Celsa Sánchez (NIC Chile)

• Why: A surprising result about a "boring" attribute: ORIGIN no longer means what RFC 4271 says it means — operators deliberately rewrite it as a policy tool, which breaks any analytics, teaching material, or tooling that assumes documented semantics.
• What: Twelve months (2025) of RIBs from four RouteViews collectors (Chile, Mexico, Fortaleza, Rio), filtered to LACNIC prefixes. Expected ORIGIN distribution is ~90% IGP / 9% INCOMPLETE / 1% EGP; reality diverges wildly by collector. Rio shows 90% of prefixes with MIXED origins (different peers at the same collector see different ORIGIN values for the same prefix + origin AS), including 12% triple inconsistency (IGP+EGP+INCOMPLETE); Fortaleza — same country, similar peer count — shows only ~11% mixed. EGP usage in Fortaleza jumped abruptly from August 2023.
• How: Monthly RIBs converted to text, filtered with monthly LACNIC delegated files, grouped per unique prefix and classified by ORIGIN. The anomaly resolves through an operator case study: that operator deliberately re-marks routes learned from remote peers as EGP, because ORIGIN is evaluated before next-hop distance in best-path selection — using the attribute as a policy lever rather than a provenance descriptor. Corroborated by an independent RIPE 91 talk on BGP ORIGIN rewriting (James Bensley).
• Where applicable: Anyone consuming BGP data — analytics, path-prediction tools, policy engines — or teaching BGP. Measurement is LACNIC-scoped, but the deck explicitly notes the phenomenon is not regional; the closing question ("change the attribute, or change how we interpret it?") is an IETF-shaped problem.