July 14, 2026

Reading an AS path without lying to yourself

An AS path looks authoritative because it is a tidy list of numbers. It is still a rumor. Each ASN in that list is claiming “I heard it from the next one.” If someone lies in the middle, the path is still a path. It is just a path through a liar.

I read paths the same way every time, left to right, then right to left, then I go get a second collector. If I skip the second collector I invent a story, and I have invented some very confident stories that were wrong.

Right-hand side first

The right-most ASN is the origin — the network that claims to have the prefix. That is the number I compare to last week, to the ROA, and to the IRR route object. If the origin changed and nobody in my company filed a change, I stop decorating the rest of the path and I treat it as an origin event. Path cosmetics can wait.

AS path   1299 3356 64500 64500 64500
origin    AS64500
next-hop  198.51.100.1
communities  3356:123 3356:575

Prepends are traffic engineering, not geography. I still catch people saying “it is transiting four times through themselves.” No. They are shouting.

Then I look at prepends. AS64500 64500 64500 64500 3356 15169 is not a long journey. It is someone making themselves look far away. Prepends are traffic engineering, not geography. I still catch people saying “it is transiting four times through themselves.” No. They are shouting.

Left-hand side is whose eyes you borrowed

The left-most ASN is the collector’s neighbor, or the collector itself, depending on how the looking glass is built. If you do not know whose RIB you are reading, you do not know whether you are seeing a tier-1 default-free view or a regional ISP that only has two transits. A path that looks “wrong” from a small collector is often just their only available exit.

This is why I never argue from a single looking glass view. I want Europe, North America, and at least one place that is not on the same continent as the prefix. When those three agree, I believe the origin. When they disagree, I believe there is a leak, a hijack, or anycast — and I go find out which.

Poisoned paths and other party tricks

Some networks stuff an ASN into the path to keep that ASN from accepting the route (because of loop detection). You will see a transit you know they are not actually using. If you start drawing a peering map from poisoned paths you will invent islands. Cross-check with ASN explorer and PeeringDB before you tell a human that two networks “must be peering.”

Communities are not in the AS path, but they ride with the route and they explain a lot of “why is this path like this.” If the glass shows communities, read them. If it does not, do not pretend you know the local-pref story.

Next hop is the part everyone skips

The next hop is where the packets actually go from that router’s point of view. A beautiful AS path with a next hop in the wrong IX fabric is how you find a recursor that is not the path you think it is. I have wasted hours on AS-path theology that a single next-hop glance would have ended.

When I teach juniors I make them write four fields on paper: origin, full path, next hop, last update. If they cannot fill those from the glass, they are not ready to page anyone.

Traceroute is not an AS path

Traceroute is ICMP and middleboxes and rate limits and “this hop does not want to talk to you.” It is a wonderful story about packets. It is a terrible court of law for BGP. Use it after you know the RIB, not instead of it. If traceroute and the AS path disagree, I believe the RIB about routing policy and traceroute about forwarding weirdness. Those are different jobs.

A global ping from many probes will tell you if the prefix is even answering. A dead prefix with a perfect AS path is still a dead prefix. Start with reachability, then argue about paths.

Read the path. Do not fall in love with it. The internet is full of tidy lists that are only half true.