Rewriting BGP Origin#

James Bensley, Inter.link

• Why: A rare public airing of a quiet interdomain game: carriers rewrite the BGP ORIGIN attribute to IGP because IGP beats INCOMPLETE in best-path selection, thereby attracting traffic. Anyone buying or selling transit — or wondering why traffic prefers a peer's path — needs to know this is happening.
• What: Based on looking-glass captures of all Tier-1s, 6 of 16 were rewriting ORIGIN to IGP at the time of the talk (AS1299, 2914, 3356, 3491, 6453, 6939; note the speaker's post-talk correction that AS3320 was incorrectly listed and does not do this). The DFZ is already >90% IGP-origin. Inter.link (AS5405) resisted, but lost customers over the resulting traffic asymmetry and will now rewrite to IGP on all eBGP advertisements — with a per-customer opt-out — arguing that universal adoption implicitly deprecates the attribute. Bonus intel: some T1s use addresses in 2/8 as BGP router IDs to win router-ID tie-breaks.
• How: Exploits the ORIGIN tie-break in best-path selection; RFC 4271 says ORIGIN "SHOULD NOT" be changed, and rewriting carriers lean on RFC 2119's wiggle room to justify "normalization".
• Where applicable: Relevant to any network announcing prefixes or selecting transit providers. The who-does-it list is a point-in-time snapshot (October 2025) and the game is zero-sum — expect more networks to follow once competitors start.