BGP (Border Gateway Protocol)
Definition
The routing protocol that autonomous systems use to advertise the IP address ranges they control to one another. BGP is the mechanism underlying global internet routing. Investigators use BGP data to confirm which network is originating traffic from a given address range.
- Function
- Inter-network routing advertisement
- Scope
- Between autonomous systems
- Reach
- Underlies global internet routing
- Forensic use
- Confirms which network originates an IP range
Common questions
Why would an investigator look at BGP data instead of just a WHOIS record?+
WHOIS shows who registered an address block, but BGP announcements show which network is actually routing and originating traffic for that block at a given time, and the two can differ.
Can BGP routing be manipulated to hide the true origin of traffic?+
Yes, BGP hijacking, where a network falsely announces routes for address space it does not own, is a known technique, so BGP data should be corroborated with other sources rather than trusted alone.
Related terms
- Autonomous System (AS)
- A collection of IP networks operated under a single routing policy and identified by a unique Autonomous System Number (ASN). ISPs, large...
- CIDR (Classless Inter-Domain Routing)
- A compact notation for IP address ranges that appends a prefix length to the address, such as 192.168.1.0/24. The prefix length states...
- IPv6 Privacy Extensions (RFC 8981)
- A mechanism defined in RFC 8981 (formerly RFC 4941) by which IPv6 hosts generate temporary randomised addresses for outbound connections, rotating them...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- RIR (Regional Internet Registry)
- One of five organisations that allocate IP address blocks by region: ARIN (Americas), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific),...