I recently dug into one of the internet’s most widespread but least-discussed routing manipulations: the systematic rewriting of BGP ORIGIN attributes. What I found is both fascinating and deeply troubling for anyone who cares about how the internet actually works.
The ORIGIN attribute in BGP is supposed to indicate how a route was injected into the routing system. It’s a mandatory field that routers evaluate during path selection, and RFC4271 explicitly states it should never be modified after being set by the originating AS. Yet through analysis of BGP collectors across the internet, roughly 70% of observed paths have a different ORIGIN value than what the original AS set.
This isn’t a bug. It’s a feature.
The Revenue-Driven Game
Why would thousands of network operators deliberately violate the RFC? Because ORIGIN values directly influence which route gets chosen. When two paths have equal local preference and AS path length, routers select the one with the lower ORIGIN value. IGP (Interior Gateway Protocol) beats EGP beats INCOMPLETE.
So if you’re a transit provider trying to attract more traffic to your network, you have a powerful incentive: rewrite incoming routes with INCOMPLETE or EGP origins to IGP. Suddenly your path becomes the preferred choice. More traffic flows through your network. More revenue.
I traced this behavior to some of the largest ASes on the internet. Six out of 16 Tier-1 networks are rewriting ORIGIN values. Twenty-six percent of the top 50 ASes by customer cone are doing it. These aren’t small players or misconfigured routers. These are the backbone providers deliberately gaming the system.
One network engineer I spoke with confirmed they’re rewriting ORIGIN to EGP on routes from peers or providers to deprioritize them against customer routes. It’s strategic. It’s calculated. And it’s working.
What This Actually Changes
The impact isn’t theoretical. When I looked at the actual routing changes these manipulations create, the numbers are staggering. In my experiment, ORIGIN rewriting secured an additional 12 paths for the manipulators in IPv4 (an 18% increase) and 33 additional paths in IPv6 (a 40% increase). Some of those paths now traverse Tier-1 networks when the original route wouldn’t have.
This means traffic is being systematically diverted toward large ISPs away from alternative providers. It’s a silent redistribution of internet traffic. For developers working with CDNs or managing critical infrastructure, this affects latency, reliability, and which networks your traffic actually travels through.
Why Nobody’s Stopping It
The depressing part? The internet community knows this is happening. James Bensley presented the widespread adoption of this technique at RIPE 91. Celsa Sánchez investigated it further at LACNIC 45. These presentations didn’t trigger immediate enforcement or protocol changes. Instead, they triggered an arms race.
Network operators faced a choice: comply with the RFC and lose traffic to competitors, or join in the manipulation and stay competitive. Unsurprisingly, most chose to compete. As one engineer said, rather than wait for competitors to resume RFC compliance, operators quickly resort to rewriting ORIGIN just to level the playing field.
There’s an Internet-Draft proposing ORIGIN deprecation, but it’s expired. The IETF has discussed making ORIGIN less relevant in BGP path selection, but nothing’s been standardized yet. Meanwhile, the manipulation continues unchecked.
The Fundamental Problem
The core issue is that ORIGIN was designed for a different internet. Back then, routes were mostly straightforward. Today, with hyperscalers and CDNs bypassing traditional transit through direct peering, and with clear financial incentives to manipulate routing, ORIGIN is being weaponized.
I think the honest question we need to ask is whether ORIGIN has any meaningful role in modern BGP path selection at all. If 70% of paths have unreliable ORIGIN values, can routers reasonably depend on it? If the only networks following the RFC are at a competitive disadvantage, how long will RFC compliance last?
The tragedy is that BGP security already has enough challenges without adding systematic protocol violation from major networks. We need ORIGIN to mean something, or we need to stop pretending it does.