BGP’s New Shield Has a Blind Spot: Why Two Tier-1 Carriers Strip OTC

A Route Leak Standard Meets the Real Internet

BGP route leaks remain one of the Internet’s most reliable ways to turn a performance incident into a global routing problem. A new Cloudflare analysis shows that RFC 9234 has moved from specification to partial operational reality, but its protective OTC attribute is being stripped by two Tier-1 carriers along a significant share of observed paths.

Across three months of peering data, 67 autonomous systems were observed setting the OTC attribute. Yet the same study found that 33.1 percent of IPv4 paths and 17 percent of IPv6 paths had the OTC value stripped in transit.

Two Tier-1 networks, GTT and Arelion, account for 96.6 percent of IPv4 OTC-absent paths. The performance stakes are direct: each stripped attribute removes an automatic safeguard against traffic taking unauthorized, congestion-prone paths.

Turning Routing Intent into Protocol-Enforced Rules

RFC 9234 codifies a simple idea: the BGP session itself should declare the economic relationship between two networks. Instead of relying on hand-written prefix filters, operators configure a BGP Role such as provider, customer, peer, route server, or route server client.

The Role is exchanged during session negotiation. If two roles form an invalid pairing, the session is rejected with a Role Mismatch notification.

That handshake failure is valuable. It surfaces a relationship mismatch before it can become a route leak incident.

How the Only to Customer Attribute Works

The Only to Customer attribute, or OTC, is an optional transitive path attribute with type code 35. It carries a single AS number that marks the point after which a route may only travel downward to customers.

A route is stamped when it first stops moving strictly upward. If a route is sent to a customer, peer, or route server client without OTC, the sender attaches its own AS number.

If a route is received from a provider, peer, or route server without OTC, the receiver attaches the remote AS number.

Once OTC is present, compliant routers enforce downward-only propagation. Any OTC-carrying route received from a customer or route server client is treated as a leak and rejected.

The two-sided setting rule helps partial deployment, but it also obscures who set the attribute. That ambiguity makes adoption tracking harder than a simple OTC count would suggest.

If a route is received from a Provider, a Peer, or an RS and the OTC Attribute is not present, then it MUST be added with a value equal to the AS number of the remote AS.

Strict mode offers a stronger guarantee: sessions without a Role capability can be rejected outright. In the current adoption phase, that option remains unrealistic for most networks.

Adoption Numbers and the Tier-1 Attribute Stripping Problem

Public routing data initially provided a noisy view. A naive count of distinct OTC values produced 361 potential setters, but many were simply filling in missing values from upstream peers, providers, or route servers.

After eliminating those ambiguous cases, the analysis identified only 36 autonomous systems that could be considered potentially RFC 9234-compliant. Cloudflare’s direct peering telemetry later refined that view: 67 ASes were observed setting OTC toward the observing network over a three-month window.

Route servers and individual operators using open-source BGP implementations appear overrepresented among early adopters. That matters because route servers sit in propagation paths for many prefixes and can extend leak protection even when other networks lag.

But the larger finding was unexpected. Two Tier-1 carriers, GTT (AS3257) and Arelion (AS1299), were stripping OTC entirely.

Across all observed paths in the controlled experiment, 33.1 percent of IPv4 routes and 17 percent of IPv6 routes had OTC absent. GTT and Arelion together appeared in 96.6 percent of IPv4 and 92.9 percent of IPv6 OTC-absent paths.

Arelion accounted for the vast majority of those instances. GTT consistently dropped the attribute, while Arelion showed inconsistent stripping across its network with 71.4 percent of IPv4 and 40.7 percent of IPv6 paths lacking OTC when directly connected.

Both carriers confirmed the behavior was part of defensive configurations following historical BGP error-handling incidents. After the finding, Arelion deployed changes to preserve OTC, and follow-up checks confirmed the attribute was no longer missing through AS1299.

GTT, by contrast, still removes OTC in current configurations. Until that changes, route leak prevention through AS3257 will remain degraded for early RFC 9234 adopters.

What Partial Deployment Means for Network Performance

Route leaks are not just policy failures. They force traffic through unintended paths that can saturate interconnections, add latency, and create packet loss far from the leaking network.

Every OTC attribute stripped in transit removes an automatic safeguard that would otherwise stop a leaked route before it reaches a provider or peer. The result is performance risk concentrated in the very paths that carry the most traffic.

The vendor picture remains split as of August 2026. Juniper Junos, MikroTik RouterOS, BIRD, OpenBGPD, and FRR already support RFC 9234.

• Planned: Cisco IOS XR in release 26.4.1.
• No current support: Arista EOS, Nokia SR OS, Huawei, Extreme SLX-OS, ArcOS, GoBGP, ExaBGP.

For performance-focused teams, the practical lesson is dual: deploy Roles where vendor support exists, and pressure upstream transit providers to preserve OTC. A standard is only as effective as the transit path that carries it.

The Next Leak Will Test Every Hop

RFC 9234 can stop many route leaks automatically, but partial deployment and attribute stripping mean that protection remains uneven across the Internet. For teams whose performance budgets depend on predictable global routing, managed WordPress cloud hosting from Andres SEO Expert is engineered for that reality — talk to our team.