What is BGP hijacking? A Practitioner's Definition

Definition

BGP hijacking is the unauthorized announcement of internet routing information, causing traffic for one IP prefix or autonomous system to be sent to the wrong network. In practice, it is a routing integrity failure that can be accidental or malicious, with impact ranging from outages to traffic interception.

How it works

The internet is made up of thousands of independently operated networks called autonomous systems, or ASes. They exchange reachability information using the Border Gateway Protocol, better known as BGP. When one network tells its peers, “I know how to reach this IP range,” other networks may accept that claim and propagate it further.

That trust model is where hijacking happens.

A BGP hijack usually starts when an AS announces a prefix it should not announce. That can happen in a few common ways:

• Origin hijack: a network claims to originate a prefix owned by someone else.
• Subprefix hijack: a network advertises a more specific route, such as announcing /24 blocks inside a legitimate /16. Because BGP often prefers the more specific route, traffic may follow the attacker.
• Route leak: a network accidentally advertises routes learned from one peer to another peer or provider, violating routing policy and creating unintended paths.

Once the bad route is accepted upstream, traffic may be:

• Blackholed, causing outages or denial of service
• Redirected, sending users to the wrong destination
• Intercepted, if the hijacker forwards traffic after inspecting it
• Degraded, because traffic takes a longer or unstable path

For defenders, the key point is that BGP hijacking is not just a carrier problem. If your business runs public services, cloud workloads, VPN gateways, or SaaS platforms, a route hijack can make them unreachable or expose traffic to manipulation.

How to protect against it

There is no single control that eliminates BGP hijacking, but several measures materially reduce risk.

1. Publish and validate RPKI

Resource Public Key Infrastructure, or RPKI, lets prefix owners create Route Origin Authorizations (ROAs) stating which AS is allowed to originate a prefix. Networks that perform Route Origin Validation can reject invalid announcements.

For organizations with their own IP space and ASN, this is one of the highest-value steps you can take.

Example validation on a router will vary by platform, but the operational goal is the same:

# Conceptual workflow
# 1. Create ROAs in your RIR portal
# 2. Sync with an RPKI validator
# 3. Configure routers to mark routes as valid, invalid, or not found

2. Apply strict prefix and AS-path filtering

If you run BGP, build import and export filters for every peer and provider. Only accept expected prefixes and only advertise what you are authorized to announce.

Good filtering reduces both accidental leaks and successful hijacks.

Allow from customer:
- Only customer-owned prefixes
- Max prefix limit enforced
- Expected origin ASN checked

Deny:
- Bogon space
- Unallocated ranges
- Unexpected more-specific announcements

3. Use maximum prefix limits

A max-prefix setting can shut down or limit a session if a neighbor suddenly sends far more routes than expected. This is especially useful against route leaks.

neighbor 203.0.113.1 maximum-prefix 5000 90 restart 5

The exact syntax differs by vendor, but the control is common.

4. Monitor global routing changes

You want fast visibility when your prefixes are announced by the wrong ASN, when a new more-specific appears, or when path changes become suspicious.

Monitor for:

• Your prefix originated by an unexpected AS
• New subprefix announcements
• Sudden AS-path changes
• Reachability shifts by region
• DNS, CDN, or app latency spikes that line up with routing events

Technical Notes

Useful indicators include route monitoring alerts and edge connectivity anomalies. In logs and tooling, look for patterns such as:

ALERT: Prefix 198.51.100.0/24 seen with origin AS64499, expected AS64500
ALERT: More-specific route detected for 203.0.113.0/23 -> 203.0.113.0/24
BGP session flap with transit provider followed by path change

You can also confirm visibility from public looking glasses and routing collectors.

5. Coordinate with upstream providers

If a hijack affects your prefixes, time matters. Make sure your transit providers and DDoS or CDN partners know your authorized origin ASNs and escalation contacts. A tested incident path often resolves events faster than ad hoc outreach.

6. Harden internal change controls

Many damaging events are misconfigurations, not targeted attacks. Require peer review for route policy changes, stage them where possible, and keep versioned backups of router configurations.

When you’ll encounter it

Most security teams encounter BGP hijacking in one of four situations:

Public service outages with no obvious local fault

Your website, VPN concentrator, API, or mail gateway goes unreachable from some regions, but your own systems look healthy. DNS resolves, servers are up, and firewalls show no major issue. That is a classic sign to check routing.

Traffic anomalies involving cloud or SaaS connectivity

If users suddenly take odd paths to cloud workloads, or if a specific provider becomes unreachable while others work, a route leak or hijack may be involved.

TLS warnings or suspicious redirection during interception scenarios

In a more serious case, traffic is not just dropped but redirected. Users may see certificate errors, login interruptions, or man-in-the-middle symptoms if the hijacker tries to inspect encrypted sessions.

Provider and SOC alerting

Mature teams often first learn of a hijack from routing monitors, ISP notifications, or external researchers. If you own IP space, assume this should become part of your monitoring program, not a once-a-year curiosity.

Related terms

Border Gateway Protocol (BGP)

The routing protocol used to exchange reachability information between autonomous systems on the internet.

Autonomous System (AS)

A network or group of networks under one administrative control, identified by an ASN.

Route leak

The propagation of routes beyond their intended scope, usually due to policy error rather than direct prefix theft.

Prefix

A block of IP addresses expressed in CIDR notation, such as 203.0.113.0/24.

Subprefix hijack

A hijack that uses a more specific route than the legitimate announcement, often attracting traffic because of BGP route selection behavior.

RPKI

A framework for cryptographically attesting which ASN is authorized to originate a prefix.

Route Origin Authorization (ROA)

A signed object in RPKI that states which AS may announce a specific prefix.

What to do next

If you only take three actions, make them these:

1. Publish ROAs for all public prefixes you own.
2. Ask providers and peers whether they enforce RPKI validation and prefix filtering.
3. Set up routing alerts for origin changes and more-specific announcements.

BGP hijacking is fundamentally a trust problem in interdomain routing. For practitioners, the practical response is straightforward: reduce what others will accept from you, reduce what you accept from others, and monitor the global table as if it were part of your attack surface, because it is.

For more information on securing your network, check out our articles on BGP hijacking prevention best practices and what should be in an incident response playbook.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.