Detecting and Characterizing Exposed BGP Routers​#

Shyam Krishna Khadka, University of Twente

• Why: RFC 7454 told operators to restrict TCP 179 to configured peers twenty years ago; this measurement shows 20,432 routers across 4,194 ASes still accept unsolicited BGP OPENs — a concrete, checkable exposure for any network.
• What: An Internet-wide IPv4 scan (February 2026): 6.25M IPs respond on TCP/179, 277k speak BGP, and 141k (51%) complete an OPEN exchange. Using the BGP Identifier (unique per router per ASN per RFC 6286) plus OPEN ASN and interface ASN mapping, these resolve to 20,432 unique routers — 16,124 internal, 1,127 border, 3,181 unclassified — across 4,194 ASes. Around 75% of border routers face one AS; ~90% have fewer than 10 IPs, while 10% of internal routers expose up to 1,208 IPs. A partial vendor view via Shodan's SNMPv3 data identifies 8,871 routers (43.4%), dominated by Juniper (5,448) and Teldat (2,956).
• How: ZMap TCP/179 scan → custom BGP speaker sends OPEN → OPEN-response analysis → router/AS association and border-vs-internal classification by ASN visibility.
• Where applicable: The finding is Internet-wide and vendor-agnostic; the operator action is trivial to execute — audit your edge ACLs with nmap/zmap from outside — and the talk explicitly invites operators to explain why these ports are open.