Key Takeaways
- Cloudflare’s experiment found ~70% of observed BGP paths have ORIGIN attribute rewritten from its original value, primarily to IGP.
- 26% of the top 50 autonomous systems manipulate ORIGIN to attract traffic, distorting path selection and potentially increasing latency.
- The study recommends deprecating ORIGIN’s influence in BGP path selection to restore routing fairness and performance.
The Internet’s Routing System Has a Hidden Performance Leak
Cloudflare’s engineering team has published a study revealing that approximately 70% of observed BGP routes have their ORIGIN attribute modified from the value set by the originating autonomous system. This widespread manipulation, concentrated among the largest Tier-1 networks, directly alters path selection and traffic flow, introducing unnecessary latency and reducing routing fairness across the Internet. The findings, presented at recent RIPE and LACNIC meetings, expose a practice that has silently degraded network performance for years.
Table of Contents
BGP ORIGIN: The Attribute That Shouldn’t Be Changed
The BGP ORIGIN attribute indicates how a route was introduced into the routing table — via IGP (interior), EGP (exterior, now obsolete), or INCOMPLETE (unknown source). It has three possible values, and by design, it should never be modified after the originating AS sets it. The RFC mandates that it SHOULD NOT be changed.
The ORIGIN attribute is generated by the speaker that originates the associated routing information. Its value SHOULD NOT be changed by any other speaker.
Yet Cloudflare’s analysis of public BGP collectors from RIPE RIS and RouteViews shows that nearly 90% of routes carry IGP, but a significant minority have EGP or INCOMPLETE. More critically, when Cloudflare announced test prefixes with different ORIGIN values from their own AS (AS13335) and tracked propagation, they found that many downstream ASes rewrite the ORIGIN to IGP — even when the original was EGP or INCOMPLETE.
This manipulation is not accidental. By changing ORIGIN to a more preferred value (IGP), transit providers can make their routes appear more attractive in the path selection algorithm, which compares ORIGIN after Local Preference and AS_PATH length. This artificially diverts traffic toward the rewriting network, generating additional revenue at the expense of optimal routing.
Two-Hop Revelations: Direct Peers Caught Red-Handed
Focusing on AS_PATHs with just two hops (the peer and Cloudflare), the study identified that 352 direct peers for IPv4 and 315 for IPv6. For prefixes advertised with EGP, 32 peers changed it to IGP; for INCOMPLETE, another 32 switched to IGP. In total, nearly 10% of direct peers consistently rewrote ORIGIN to IGP.
Some peers even set ORIGIN to EGP or INCOMPLETE, effectively deprioritizing routes. One AS confirmed to Cloudflare that they rewrite to EGP on routes received from peers to favor customer routes. Others propagated multiple ORIGIN values simultaneously, indicating multi-homed configurations with selective rewriting.
Notably, two direct peers rewrote ORIGIN only for IPv4 prefixes, not IPv6, suggesting separate configuration policies for each address family. Among Tier-1 ASes, six out of 16 were found to manipulate ORIGIN to IGP, matching a prior independent study.
Longer AS_PATHs: Manipulation Extends Upstream
Extending the analysis to paths of any length using a trust-propagation algorithm, Cloudflare attributed ORIGIN behavior to 606 out of 802 visible ASes (75.6%). Of those, 64 (10.6%) were rewriting to IGP. The cumulative distribution of AS Rank shows that rewriting ASes are disproportionately high in the hierarchy: 20.3% fall in the top 50.
Overall, 26% of the top 50 ASes and 20% of the top 100 ASes manipulate ORIGIN. This concentration means that a small number of highly central networks are influencing a vast fraction of Internet routes. Indeed, 70% of unique IPv4 AS_PATHs and 67% of IPv6 AS_PATHs in the experiment had ORIGIN reset to IGP.
How ORIGIN Manipulation Degrades Network Performance
For performance engineers and network operators, the implications are clear: artificial route preference distorts the natural flow of traffic, potentially increasing latency, reducing throughput, and creating congestion points. When Tier-1 networks rewrite ORIGIN to attract traffic, they may draw traffic away from more direct or lower-latency paths. According to the Cloudflare study, rewriting to IGP secured 12 additional paths (an 18% increase) that would otherwise traverse ORIGIN-preserving networks in IPv4, and 33 more paths (40% increase) in IPv6.
These additional paths include routes that would not have touched a Tier-1 at all in the control group. This artificially funnels traffic through large ISPs, even when alternative providers might offer better performance. For content delivery networks and cloud providers that rely on optimal routing, this manipulation creates an unpredictable performance tax.
Moreover, the practice undermines trust in BGP’s path selection. If operators cannot rely on ORIGIN as a consistent signal, they may need to resort to more aggressive traffic engineering, such as AS_PATH prepending or community attributes, to counter the distortion. But these countermeasures increase operational complexity and can further fragment routing decisions.
The broader consequence is a less efficient Internet. In an era where every millisecond matters for user experience, the unforced error of ORIGIN manipulation represents a systemic performance drag. The Cloudflare team’s call for deprecating ORIGIN’s influence — by requiring BGP implementations to set it to IGP on all routes — is a pragmatic first step. Without change, the arms race of ORIGIN rewriting will continue, with no technical benefit and only selective commercial advantage.
Restoring Routing Fairness for a Faster Internet
The ORIGIN attribute was designed to convey routing information, not to be a competitive lever. Its widespread manipulation shows that the BGP protocol’s safeguards have been outpaced by economic incentives. For the performance community, this is a call to action: supporting deprecation efforts, auditing routing policies, and advocating for transparent traffic engineering. A cleaner, more predictable routing system directly translates into better performance for end users.
At Andres SEO Expert, we understand that every network optimization counts. If you’re looking to improve your site’s speed and reliability, our WordPress speed engineering services can help you achieve technical excellence. For a deeper discussion on how routing and infrastructure choices affect your performance metrics, get in touch with our team. And to learn more about our approach to digital performance, visit Andres SEO Expert.
Frequently Asked Questions
What is the BGP ORIGIN attribute and why shouldn’t it be changed?
The BGP ORIGIN attribute indicates how a route was introduced into the routing table (IGP, EGP, or INCOMPLETE). By design, it should never be modified after the originating AS sets it, as RFC mandates its value SHOULD NOT be changed. Manipulation disrupts path selection and routing fairness.
How does ORIGIN manipulation degrade network performance?
Rewriting ORIGIN to a more preferred value (like IGP) artificially attracts traffic, diverting it from more direct or lower-latency paths. This can increase latency, reduce throughput, create congestion, and impose a performance tax on content delivery and cloud providers.
Which networks are most responsible for ORIGIN rewriting?
The practice is concentrated among the largest Tier-1 networks. Cloudflare found that 6 out of 16 Tier-1 ASes manipulate ORIGIN, and 26% of the top 50 ASes and 20% of top 100 ASes engage in rewriting, disproportionately affecting a vast fraction of Internet routes.
What did Cloudflare’s study reveal about ORIGIN manipulation?
Cloudflare found that nearly 10% of direct peers consistently rewrote ORIGIN to IGP, and 70% of observed BGP routes had their ORIGIN attribute modified. Some peers also set ORIGIN to less preferred values to deprioritize routes. The manipulation was more prevalent among higher-ranking ASes.
What can be done to fix ORIGIN manipulation?
Cloudflare proposes deprecating ORIGIN’s influence by requiring BGP implementations to set it to IGP on all routes, making the attribute meaningless for path selection. Operators should also audit routing policies and advocate for transparent traffic engineering to restore routing fairness.
How does ORIGIN manipulation affect traffic routing and path selection?
Changing ORIGIN to a more preferred value (IGP) makes routes appear more attractive in BGP’s path selection algorithm (compared after Local Preference and AS_PATH length). This artificially diverts traffic toward the rewriting network, potentially increasing revenue for that network at the cost of optimal routing.
