What Is BGP? How the Border Gateway Protocol Routes the Internet
Business & Professional Services

What Is BGP? How the Border Gateway Protocol Routes the Internet

Avatar photo
Sarah Whitmore October 6, 2026 15 min read

What is BGP, and why should anyone outside the server room care about it? As a network engineer, I get this question a lot, usually from business owners and executives right after an outage has cost them money. My short answer is always the same: BGP is the system that tells the internet how to find your business. If it works, nobody notices. If it fails, your website, your apps, and your customers can disappear from the internet in minutes.

In this article, I’m going to explain BGP the way I explain it in boardrooms rather than in technical training. In other words, there won’t be any router commands or packet diagrams. Instead, you’ll get a clear picture of what BGP does, why it matters to your revenue, how it has failed before, and what questions you should ask your internet provider or IT team.

What Is BGP? The Short Answer

BGP stands for Border Gateway Protocol. Put simply, it is the set of rules that the world’s networks use to tell each other which internet addresses they can reach. Every time someone visits your website, BGP has already decided which roads their request will travel to get there.

The internet is a network of networks

Many people picture the internet as one giant system run by someone. In reality, it is made up of tens of thousands of separate networks. For example, your internet provider is one network. Likewise, Google, Amazon, your bank, and many universities each run their own. In the industry, we call each of these an autonomous system, which simply means a network run by one organization under its own rules.

None of these networks automatically knows how to reach the others. Therefore, they need a common language to share directions. That language is BGP.

Think of it as a self updating map

Here is the analogy I use most. If DNS is the internet’s phone book, giving you the address of a website (I cover that side in detail in how DNS works), then BGP is the GPS that figures out the route to that address. Cloudflare, one of the largest internet infrastructure companies, explains it in much the same way.

What’s more, this map updates itself constantly. When a road closes, such as a cable cut or a provider outage, networks quickly share new directions so traffic can flow another way. As a result, the internet keeps working even when parts of it break.

Why Business Leaders Should Care About BGP

You might be thinking that this sounds like something your ISP handles. Most of the time, that’s true. However, BGP touches your business in ways that rarely show up on an IT report until something goes wrong.

Your customers reach you through BGP

Every customer who loads your website, uses your app, or connects to your online store depends on BGP finding a path to you. Similarly, your staff reach cloud tools, payment systems, and email through those same paths. In short, if BGP can’t find your business, your business is offline, even if every server you own is running perfectly.

Outages that start outside your building

Here is the part that surprises most executives. A BGP problem can start in a network you have never heard of, in a country you don’t operate in, and still take your services offline. Later in this article, I’ll share two real examples where exactly that happened to some of the biggest brands in the world.

For that reason, BGP belongs in conversations about business continuity, vendor selection, and risk, not just in the engineering team’s notes.

How BGP Works, Without the Jargon

You don’t need to configure BGP to understand it. In fact, the basic idea fits into three steps.

Step one: networks agree to talk

First, two networks agree to connect and share directions. This is usually written into a contract, such as a deal with an internet provider or a free exchange between two companies that send each other a lot of traffic. Once connected, their equipment opens a steady conversation and keeps checking that the other side is still there.

Step two: networks announce what they can reach

Next, each network announces the blocks of internet addresses it owns or can reach. For example, my network might say, “These addresses belong to my customers, so send that traffic to me.” Then my neighbors pass that message on to their neighbors, and so on, until the whole internet has heard it.

Along the way, each announcement collects a list of every network it has passed through. Consequently, anyone receiving it can see the full journey, much like the stamps on a well traveled passport. This list also prevents traffic from going around in circles, because a network will ignore any route that already passed through itself.

Step three: each network picks its preferred route

Finally, since most destinations can be reached in several ways, each network chooses which route to use. This is where BGP gets interesting for business leaders, because that choice is not purely technical.

How BGP Decides Where Your Traffic Goes

Most people assume the internet always picks the fastest route. Surprisingly, that’s not quite how it works. Instead, BGP follows a fixed checklist, and the first rule that produces a clear winner decides the route.

Business preferences come first

At the top of that checklist sits the network’s own preference. In practice, this is set by business factors. For instance, a provider may prefer a route because it is cheaper, because a partner agreement makes it free, or because a paying customer is on the other end. Cloudflare’s engineers have made the same point publicly: routing choices often reflect contracts and policies rather than pure performance.

In other words, BGP is less like a GPS that only cares about speed and more like a logistics manager who also weighs cost, contracts, and relationships.

Shorter journeys come next

Only after those preferences does BGP look at how many networks a route passes through. Generally, fewer stops is better. After that, a series of smaller tie breakers settles the rest, as described in Cisco’s well known documentation on the subject.

What this means for your contracts

This matters to you because the route your customers take to reach you is partly shaped by the business arrangements of every network in between. Therefore, choosing an internet provider is not only about price per megabit. It is also about who that provider connects to and how well they manage these routing decisions.

Inside and Outside: Two Flavors of BGP

You may hear your IT team mention eBGP and iBGP. Fortunately, the difference is easy to understand.

External BGP

External BGP is the conversation between different organizations. For example, it’s how your network talks to your internet provider, or how two large providers talk to each other. This is the version that connects the internet together.

Internal BGP

Internal BGP, on the other hand, runs inside a single organization. Typically, it’s used by larger companies with several internet connections in different locations. Its job is to make sure every part of the company network has the same, consistent view of the outside world. It usually works alongside other internal design tools, such as VLANs that keep different types of traffic separated within each site.

For most small and mid sized businesses, internal BGP never comes up. However, if your company is growing across multiple offices, data centers, or cloud regions, it eventually becomes part of the design.

How Big Is the Internet’s Map?

To give you a sense of scale, the main routers at the heart of the internet now carry roughly a million separate routes for older style internet addresses alone. According to Geoff Huston’s annual research for APNIC, that table grew by about 54,000 entries in 2025 alone. Meanwhile, the newer IPv6 address system has its own, separate and fast growing table. If the difference between the two is new to you, see my guide to IPv4 vs IPv6.

Why that number matters to your budget

Every one of those routes takes memory in networking hardware. As a result, if your company runs its own BGP connections, the equipment you buy must handle today’s table and several years of growth. Otherwise, you may find yourself replacing expensive hardware much sooner than planned. So when your CTO or IT partner talks about router capacity, this is often why. If you’re unsure which device does what, start with network switch vs router.

When BGP Goes Wrong: Two Stories Every Leader Should Know

BGP was designed decades ago, when the networks connecting to each other mostly knew and trusted one another. Consequently, by default, networks believe the directions their neighbors give them. That trust is what makes the system fast and flexible. Unfortunately, it is also what makes failures spread so quickly.

The day YouTube was sent to Pakistan

In February 2008, the Pakistani government ordered the country’s main telecom company to block YouTube locally. To do this, the company announced that it was the destination for part of YouTube’s addresses, intending to keep that announcement inside Pakistan.

However, one of its international providers passed the announcement on to the rest of the world. Because BGP prefers more specific directions, networks everywhere began sending YouTube traffic to Pakistan, where it simply vanished. According to RIPE NCC, which documented the event minute by minute, the problem lasted around two hours before it was fixed. In the end, a single missing safety check at one provider took a global brand offline.

The day Facebook disappeared

In October 2021, Facebook, Instagram, and WhatsApp went dark for about six hours. This time, no outsider was involved. Instead, a routine maintenance change inside Facebook’s own network went wrong. As a result, Facebook’s systems stopped telling the rest of the internet how to reach them.

From the outside, Cloudflare watched Facebook’s directions vanish from the internet’s map. Without those directions, nobody could find Facebook’s servers, including, reportedly, some of Facebook’s own staff trying to fix the problem. Meanwhile, apps and users kept retrying, and Cloudflare saw global lookup traffic jump to about thirty times its usual level.

What these stories teach decision makers

Both stories carry the same lesson. First, routing mistakes can come from inside or outside your organization. Second, they spread fast, often in minutes. Finally, recovery depends on having the right people, processes, and backup access in place before anything breaks, including a clear escalation path through your support team. The structure of that team matters too; see help desk vs service desk.

Is BGP Secure?

The honest answer is: not by default. However, the industry has made real progress, and it’s worth understanding what that progress looks like.

The trust problem

Because networks accept each other’s directions, someone can announce addresses they don’t own. Sometimes it’s an accident, as in the YouTube case. Other times, it’s deliberate, which we call a hijack. In either case, traffic meant for one company ends up somewhere else. According to Cloudflare, signs of a hijack can include slow performance, higher delays, and traffic going to unexpected places.

RPKI: a signed deed for your internet addresses

The main fix is called RPKI, short for Resource Public Key Infrastructure. Think of it as a digitally signed property deed. The rightful owner of a block of addresses publishes a signed record saying which network is allowed to announce it. Then other networks can check every announcement against those records and reject the fakes. Had this been widely used in 2008, the YouTube incident would likely have been stopped automatically.

Adoption is finally catching up

Encouragingly, adoption is growing fast. According to MANRS, more than half of internet routes are now covered by these signed records. Still, there is a gap: research shared at a MANRS community meeting in late 2025 found that over a quarter of older style addresses still have no coverage, often because of legacy setups or simple lack of awareness.

MANRS: an industry pledge

MANRS, which stands for Mutually Agreed Norms for Routing Security, is a global initiative where network operators commit to basic good practices. For example, members agree to filter bad announcements, prevent fake traffic, and keep contact details current so problems can be resolved quickly. By late 2025, it had grown to nearly 1,300 participants.

Does Your Company Need BGP?

Most small businesses never deal with BGP directly. In that case, your internet provider handles it, and that’s perfectly fine; your time is better spent on a solid small business network setup. Nevertheless, there comes a point where running your own BGP makes good business sense.

Signs you may need it

You should seriously consider it if:

  • Your website or online services generate revenue every minute, so downtime is expensive.
  • You want two or more internet providers so that if one fails, customers can still reach you automatically, without changing your addresses.
  • You need more control over how traffic reaches you, whether for performance, cost, or compliance reasons.
  • You’re connecting your offices or data centers directly to cloud providers, since many of those private connections use BGP behind the scenes.

What it takes

To run BGP yourself, you’ll typically need a registered network number, your own block of internet addresses (or permission to use your provider’s), equipment that can handle the internet’s growing map, and, above all, skilled people. That last point matters most. A poorly configured BGP setup doesn’t just affect your company. In fact, it can cause problems for other networks too. If you don’t have that expertise in house, a managed provider can fill the gap; here’s a breakdown of managed IT services cost.

Questions to ask your ISP or IT partner

Even if you never run BGP yourself, these questions are worth asking:

  • Do you filter routing announcements from your customers and partners?
  • Do you check announcements against RPKI and reject invalid ones?
  • Are our internet addresses covered by a signed RPKI record?
  • Are you a MANRS participant?
  • If our primary connection fails, how quickly will traffic move to the backup, and have we tested it?

Their answers will tell you a lot about how seriously they take your uptime. Also, you can check whether your current provider rejects invalid routes using Cloudflare’s free routing security test, which runs right in your browser.

Final Thoughts

So, what is BGP? Ultimately, it’s the quiet agreement system that lets tens of thousands of independent networks behave like one internet. It is old, it runs largely on trust, and it has caused some of the most famous outages in history. Even so, it is also remarkably resilient, and it’s getting safer every year.

For business leaders, the takeaway is simple. You don’t need to understand every technical detail. However, you do need to know that your customers find you through BGP, that routing problems can start far outside your walls, and that the right provider, the right design, and a few good questions can protect your revenue when something goes wrong.

Frequently Asked Questions

What is BGP in simple terms?

BGP is the system the world’s networks use to share directions with each other, so that internet traffic can find its way to any website or service. You can read a beginner friendly overview at the Cloudflare Learning Center.

Does my small business need BGP?

Usually not. Your internet provider handles it for you. However, if downtime is very costly or you want two providers with automatic failover, it may be worth discussing with your IT support partner. For a deeper technical background, see the course at NetworkLessons.

How does BGP choose which route to use?

It follows a fixed checklist. First come the network’s own business preferences, then the number of networks a route passes through, and finally several tie breakers. See the full order in Cisco’s documentation.

What is a BGP hijack?

A hijack happens when a network announces internet addresses it doesn’t own, either by accident or on purpose, so traffic meant for one company goes somewhere else. Learn more in Cloudflare’s security glossary.

What caused the 2021 Facebook outage?

A faulty maintenance change inside Facebook’s network caused its systems to stop telling the internet how to reach them, taking its apps offline for about six hours. Read the analysis on the Cloudflare Blog.

What is RPKI?

RPKI is a system of digitally signed records that prove which network is allowed to announce a block of internet addresses, helping others reject fake announcements. Learn more from MANRS.

How can I check if my internet provider is secure?

Run Cloudflare’s routing security test in your browser. It checks whether your provider rejects invalid routing announcements.

References

Standards and vendor documentation

Incidents, measurement, and routing security

  • RIPE NCC. YouTube Hijacking: A RIPE NCC RIS Case Study. ripe.net
  • Cloudflare Blog. Understanding How Facebook Disappeared from the Internet. blog.cloudflare.com
  • Huston, G. Opinion: Learning from Facebook’s Mistakes. APNIC Blog, October 2021. blog.apnic.net
  • Huston, G. BGP in 2025. APNIC Blog, January 2026. blog.apnic.net
  • MANRS. Year to Year Growth of the Distributed RPKI Database. manrs.org
  • MANRS. Recap: 2nd MANRS Community Meeting 2025. manrs.org
  • Cloudflare. Is BGP Safe Yet? isbgpsafeyet.com
Tags: