September 1, 2026
What BGP Actually Does (and Why Your Packets Depend on It)
Every time a video starts, a bank transfer clears, or a phone finds a cell tower’s internet path, Border Gateway Protocol is in the middle. BGP does not carry your packets. It decides which networks are allowed to claim them.
The internet is a federation, not a single network
No company owns the internet. Thousands of independently operated networks — Autonomous Systems — peer, buy transit, and exchange reachability. An Autonomous System Number (ASN) is the passport. Cloudflare is AS13335. Google is AS15169. A regional ISP might be a five-digit private-looking number that is still globally unique in the public table.
Those networks do not flood every destination address. They advertise prefixes: blocks such as 203.0.113.0/24 or 2001:db8::/32. BGP is the language used to say “I can reach this block, and here is the list of ASes you would traverse if you send traffic to me.”
What a BGP announcement contains
A useful mental model is a postcard, not a packet. Typical fields operators care about:
- NLRI / prefix — the block being announced.
- Origin ASN — who claims to own or originate that block.
- AS_PATH — the sequence of ASes already traversed. Shorter is often preferred, but policy beats hop count.
- Next hop — the address the receiving router should use as its first jump.
- Communities — tags that tell peers how to treat the route (local-pref hints, blackhole, geographic scope).
If two networks announce the same prefix, routers pick one using a local policy stack: weight, local preference, AS path length, origin type, MED, and so on. That is why “the internet’s shortest path” is a myth. Policy wins.
Why this shows up in an IP lookup
When you paste an address into IP Lookup or BGP Lookup, you are not asking “who registered this last year.” You are asking “who is originating this address right now in the live table, and what prefix covers it.”
That distinction matters during incidents. A registry record can lag. A live origin ASN tells you which network is currently attracting packets. Geolocation and rDNS are extra context. The routing truth is the announced prefix plus origin.
Failure modes that look like “the internet is down”
Most outages users blame on “the cloud” are local. The ones that are not often look like this:
- A prefix is withdrawn and traffic has nowhere trusted to go.
- A more-specific prefix is announced by the wrong ASN (classic hijack or leak).
- An AS path becomes so long or so filtered that a region loses a destination.
- RPKI marks an origin invalid and networks that enforce ROV drop it.
None of those require malware on your laptop. They are control-plane events. That is why a looking glass and an RPKI check belong next to ping, not after it.
How to use this on a workday
Start with the address that failed. Look up the covering prefix and origin ASN. Confirm the organization matches the service you think you are reaching. Then open Looking Glass and compare AS paths from more than one region. If paths diverge wildly, or one collector has no route, you have a routing story rather than an application story.
Bulk lookups help when a whole customer prefix or a vendor range is involved. One address is a symptom. A prefix is the unit BGP actually moves.
Try it: search any public IP on bgplookup.io, then jump to the origin ASN and announced prefix. Note whether geo, registry, and live origin agree.
IPv4 and IPv6 are two tables that can disagree
Operators sometimes treat IPv6 as a weekend project. Dual-stack destinations then fail in one family only. A site that “works on the phone” and fails on the laptop is often a v6 path with a broken origin or a firewall that still thinks NAT is hiding everyone. Look up both addresses. Looking glasses that show a clean v4 path and an empty v6 path have already explained the ticket.
Home users meet this when an ISP enables v6 without a firewall, or when a VPN covers v4 only. Businesses meet it when a partner publishes AAAA records before their ROAs and filters exist.
Communities, blackholes, and the knobs nobody sees
A route can be valid and still be treated as poison. Remote-triggered blackhole communities, no-export tags, and geographic well-known communities change who receives the announcement. If a prefix vanishes from one collector and remains on another, ask whether policy hid it before you assume a crash. Live lookup tools show reachability from public views. They cannot show a community your upstream strips.
A vocabulary you can use in tickets
- Withdrawn — the prefix left the table. Traffic must use a less-specific or die.
- Prepended — an ASN repeated in the path to look longer and attract less traffic.
- More-specific — a longer prefix that steals traffic from a covering aggregate.
- Default-free — a view that does not rely on a 0.0.0.0/0 crutch.
Write tickets with those words plus the prefix and origin. “Internet is slow” is not actionable. “203.0.113.0/24 origin moved from AS64500 to AS64496 at 11:40 UTC” is.
FAQ
FAQ
Is BGP the same as IP routing inside a company?
No. Interior protocols (OSPF, IS-IS, EIGRP) move traffic inside one administrative domain. BGP is the protocol between domains.
Does a shorter AS path always win?
Only after local preference and other policy. Many networks prefer a paid or settlement-free peer over a shorter but expensive path.
Can I run BGP at home?
Yes, with your own ASN and PI or provider-independent-style space, but most homes should not. A stable default route from one ISP is enough.