What Is BGP Hijacking?
On this page
BGP hijacking reroutes internet traffic by lying about who owns which addresses. BGP (the Border Gateway Protocol) is how the internet’s independent networks tell each other which IP ranges they can deliver to — and it was built on trust. Announce a false route and traffic for those addresses flows to you instead, potentially at massive scale. It is a man-in-the-middle attack on the internet’s routing fabric.
How does it work?#
Networks (autonomous systems) advertise the IP ranges they serve via BGP, and routers generally believe them:
- An attacker’s (or misconfigured) network announces a range it does not own — often a more specific prefix, which routing prefers.
- Neighboring networks accept the announcement and update their routes.
- Traffic for those addresses is now delivered to the attacker.
- They can drop it (outage), inspect it, or relay it while eavesdropping.
Because the trust is implicit, a single bad announcement — malicious or accidental — can redirect traffic for major services, as several high-profile incidents have shown.
How is it defended?#
| Control | Effect |
|---|---|
| RPKI | Cryptographically validates route origin |
| Route filtering | Reject implausible announcements from peers |
| Route monitoring | Alert on unexpected origin changes |
| Encryption (TLS) | Redirected traffic stays unreadable |
RPKI is the structural fix: it lets networks cryptographically declare which systems may announce their prefixes, so routers can drop invalid routes.
BGP hijacking is a routing-layer attack on the whole internet. More at the Network Security hub.
Frequently asked questions#
What is BGP hijacking?
BGP hijacking is when a network falsely announces ownership of IP address ranges it does not control, causing internet traffic destined for those addresses to be routed to the attacker instead. Because BGP — the protocol that connects the internet’s networks — was designed to trust announcements, a bogus route can redirect large amounts of traffic.
How is BGP hijacking prevented?
The main emerging defense is RPKI (Resource Public Key Infrastructure), which cryptographically validates that a network is authorized to announce a given IP range, so routers can reject invalid announcements. Route filtering and monitoring for unexpected route changes also help. Adoption of RPKI is growing but not yet universal.