Last updated: May 1, 2026
Border Gateway Protocol routes the Internet between Autonomous Systems (AS) — the ~100,000 distinct networks operated by ISPs, content providers, hyperscalers, and large enterprises. It works on a trust model: each AS announces “I have these prefixes, here is the path”, and every other AS believes it. When that trust breaks — by accident or on purpose — entire countries lose connectivity for hours. This module covers the architecture, the attack classes (hijack, leak, MITM), and the modern mitigations (RPKI, BGPsec, MANRS) that operators and enterprises must understand in 2026.
BGP in 90 seconds — the model you must hold in your head
Each AS has a unique number (ASN, 16 or 32 bit). ASNs maintain BGP sessions over TCP/179 with peers (their neighbours). A BGP session exchanges UPDATE messages: “I can reach prefix 203.0.113.0/24, AS-PATH is [AS65010 AS65020 AS65030]”. Each receiving AS prepends its own ASN before re-announcing. Path selection: from all received paths to the same prefix, choose the one with the highest local-preference, then the shortest AS-PATH, then more tie-breakers (origin, MED, eBGP-over-iBGP, lowest router-id). The principle: BGP routes by policy, not by physical optimality. Two ISPs may have a direct fibre between them but route via a third because of business agreements. Every BGP-related security incident is a misuse of one of these mechanisms — usually a more-specific prefix that wins longest-prefix match, or a falsely shorter AS-PATH.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.