CONCEPT Cited by 1 source
BGP ORIGIN attribute¶
The ORIGIN attribute is a well-known mandatory BGP path attribute (RFC 4271 §5.1.1) that indicates how a route was originally injected into BGP. It has three possible values:
| Value | Code | Meaning |
|---|---|---|
| IGP | 0 | Route is interior to the originating AS (most common; 89.8% of observed routes) |
| EGP | 1 | Route was learned via the now-obsolete Exterior Gateway Protocol (historical; 3.5%) |
| INCOMPLETE | 2 | Route was learned via redistribution or an unknown external source (6.7%) |
Role in path selection¶
ORIGIN is evaluated at step 3 of BGP's deterministic best-path selection process (RFC 4271 §9.1):
- Highest Local Preference
- Shortest AS_PATH length
- Lowest ORIGIN value (IGP < EGP < INCOMPLETE)
- Lowest MED
- eBGP over iBGP
- Lowest IGP cost to next-hop
- Lowest router ID
Because it evaluates early in the ladder — before MED and the iBGP/eBGP preference — a single-value change from INCOMPLETE (2) to IGP (0) can redirect traffic through a different transit provider when Local Preference and AS_PATH length are equal.
Widespread manipulation¶
RFC 4271 §5.1.1 states: "Its value SHOULD NOT be changed by any other speaker." Despite this guidance, Cloudflare's 2026 controlled experiment found:
- ~10% of direct peers rewrite ORIGIN to IGP for non-IGP prefixes
- 6 out of 16 Tier-1 ASes manipulate ORIGIN (matching RIPE 91 findings)
- ~70% of observed IPv4 AS_PATHs have ORIGIN rewritten to IGP by intermediate ASes
- 26% of the top-50 ASes (by CAIDA AS Rank) participate in rewriting
The manipulation is revenue-driven: transit providers set ORIGIN=IGP to make their routes win the tiebreaker, attracting more traffic through their links. Once one Tier-1 does it, competitors follow to avoid disadvantage — creating an arms race.
Some ASes use the mechanism in reverse, setting ORIGIN=EGP on peer/provider-learned routes to deprioritize them relative to customer routes.
Deprecation proposal¶
Given the manipulation's prevalence and lack of valid technical justification, the community has proposed deprecating ORIGIN's role in path selection. The expired Internet-Draft draft-marenamat-idr-scrub-bgp-origin recommended scrubbing ORIGIN by requiring implementations to set IGP on all routes received and advertised. Cloudflare supports reviving this effort. (Source: sources/2026-07-24-cloudflare-bgp-origin-attribute-manipulation)
Seen in¶
- sources/2026-07-24-cloudflare-bgp-origin-attribute-manipulation — primary investigation with controlled experiment and quantified results