What BGP is
BGP (Border Gateway Protocol) is designed for exchanging route information between networks operated by entirely separate organizations, unlike the routing used inside a home or office network. The internet isn't really one giant network -- it's a 'network of networks,' made up of countless individually operated networks run by ISPs, cloud providers, universities, and companies, all connected through BGP.
What an autonomous system (AS) is
ISPs, major cloud providers, universities, and large companies each operate one or more autonomous systems, and are assigned a globally unique AS number (ASN) by an international internet registry. Strictly speaking, BGP doesn't exchange routes between individual IP addresses -- it exchanges routes between autonomous systems.
Route advertisement and best-path selection
When an AS advertises the IP ranges it's responsible for, neighboring ASes record that in their routing tables and pass the advertisement along to their own neighbors. As this repeats, routers across the world learn which sequence of ASes (the AS path) leads to a given destination, and when multiple candidate paths exist, they pick one using criteria such as which path passes through fewer ASes.
Peering vs transit relationships
Large carriers and content providers often connect directly at internet exchange points (IXPs) and exchange each other's traffic for free -- a relationship called peering. Smaller networks without their own long-haul infrastructure instead pay a larger carrier for a 'transit' contract that provides a route to the entire rest of the internet.
What BGP hijacking is
BGP hijacking happens when a network advertises an IP range it doesn't actually control -- by mistake or on purpose -- pulling traffic meant for another network toward the wrong destination. Because BGP is built to trust the routes its neighbors advertise, a single misconfiguration or malicious advertisement can misdirect traffic meant for that range. Real-world configuration mistakes at individual carriers have knocked major services offline worldwide more than once.
Why BGP was designed around trust
BGP was created in the late 1980s, when relatively few organizations were connected to the internet and a baseline of mutual trust was reasonable. As a result, its original design has no built-in cryptographic way to verify that an advertisement genuinely comes from the legitimate owner of that IP range -- a structural weakness that persists to this day.
How RPKI verifies routes
RPKI (Resource Public Key Infrastructure) lets address registries cryptographically certify, in advance, which AS is authorized to advertise which IP range. Networks that adopt RPKI can check incoming BGP advertisements against these certificates and automatically filter out advertisements from unauthorized sources. Not every network has adopted it yet, so raising adoption remains an ongoing challenge for the internet security community.
Why one small mistake can cause a worldwide outage
If a single AS mistakenly advertises far more IP space than it actually owns, or leaks bad route information, neighboring ASes accept and repropagate it, letting the error spread across the internet within minutes. That's why 'a BGP routing issue caused by a configuration error' shows up so often as the root cause behind major outages at large internet services and cloud providers.