BGP

A network that holds a block announces it to the networks it connects to. Each of them passes the announcement on and adds its own AS number, so every route carries the list of networks it crossed: the AS path. The number at the far end of that list, the network that first announced the block, is its origin.

When a router hears several routes to the same block, its own policy decides first. Among routes it likes equally, it takes the one that crosses the fewest networks. Geography and congestion play no part. BGP itself runs over TCP, on port 179.

BGP was sketched over lunch. In 1989, at an IETF meeting, Kirk Lougheed of Cisco and Yakov Rekhter of IBM wrote the design on napkins, which is why it is known as the two-napkin protocol. Photocopies of the napkins survive in Cisco's archive. The napkins themselves ended up in a landfill. The design became RFC 1105 in June 1989, built on experience with the older Exterior Gateway Protocol.

Version 4 arrived in July 1994 and removed the address classes from routing. BGP-4 "eliminates the concept of network 'class' within BGP", which is what let blocks of any size, not only class A, B or C networks, be announced. The current standard, RFC 4271, dates from January 2006.

BGP was designed without security checks: any network can announce any block, and the protocol itself verifies nothing. On 24 February 2008 Pakistan Telecom announced 208.65.153.0/24, a slice of YouTube's 208.65.152.0/22, in order to block YouTube at home. An upstream provider passed the announcement on to the rest of the internet. Routers prefer the most specific route, so YouTube traffic from around the world went to Pakistan.

It lasted just over two hours. YouTube answered by announcing two even smaller /25 blocks, which beat the /24, and the upstream provider withdrew the Pakistani route at 21:01 UTC. The opposite failure is a network withdrawing its own routes. On 4 October 2021 a maintenance command cut Facebook's backbone. Its DNS sites then withdrew their BGP announcements, as designed for a broken link, and Facebook's name servers became unreachable "even though they were still operational".

The registries now let a holder sign a route origin authorisation (ROA). It is a signed statement, published in the registries' RPKI system, that a given AS number may originate routes for a block. Since 2013 a standard has defined how networks check routes against it: each route is valid, invalid or not found, and a network can be set to drop the invalid ones.

Coverage is growing but incomplete. On 19 September 2026, 59.0 percent of all delegated IPv4 addresses were covered by a ROA. The range ran from 45.3 percent of ARIN's space to 77.0 percent of the RIPE NCC's, the same figures the registries publish in their daily adoption report.

On our free proxy list, 85.5 percent of the live proxies on 19 September 2026 sat in blocks whose ROA names the network announcing them. Another 13.3 percent sat in blocks with no ROA, and 1.3 percent in blocks whose ROA names other networks. RPKI settles who may announce an address, not what the address is used for.

For ISP proxies the announcing network is the whole point. An address sold as residential has to be announced by an internet provider's network, because that is the ASN an IP lookup reports. Some sellers write that a block can be announced from their own data centre and still show the provider's ASN. Routing data does not work that way: a lookup reports whichever network originates the route.

Public route collectors, such as the RIPE NCC's, show which network announces any block, so a buyer can check before paying.