BGP in 2026: Threats, Incidents, and Solutions#

Erika Vega Valenzuela, Álvaro Retana, Guillermo Cicileo

• Why: The best single map of the current BGP threat and mitigation landscape, grounded in regional incident data rather than vendor framing. Directly in the PM's routing-security and BGP-internals lane.
• What: A structured tutorial mapping each threat class to its mitigations — origin hijack → ROA/ROV; AS_PATH manipulation → ASPA (with BGPsec still undeployed); route leaks → filters, BGP Roles/OTC, ASPA; session abuse → GTSM, TCP-AO, max-prefix; volumetric DDoS → RTBH, BLACKHOLE community, Flowspec — plus real incident data for LAC and a monthly Argentina table for Jan–Oct 2026 (route misoriginations ranging 0–6 per month, bogon announcements 2–8, route leaks 0).
• How: Threat/example/mitigation blocks sourced from RFC 4272, RFC 7454, SIDROPS, GROW, and MANRS; concrete config patterns for bogon prefix-lists and AS-path ACLs; a discussion of why static bogon lists go stale (today's bogon is tomorrow's IANA allocation); IRR vs RPKI as the two external sources for validating received announcements.
• Where applicable: Broadly applicable to any BGP operator; the incident tables are LAC/Argentina-specific public-monitoring data. Ends with a practical adoption roadmap from information hygiene to path protection.