BGP has a way of making tiny fields feel bigger than they should be. Cloudflare's new work on the ORIGIN attribute is a clean example. An old mandatory bit of routing metadata, originally meant to describe where reachability information came from, is still close enough to the route-selection machinery that rewriting it can change which networks carry traffic.

Cloudflare published the analysis on July 24 after running controlled IPv4 and IPv6 experiments from its peering locations. The company announced test prefixes with different ORIGIN values, watched global BGP updates through public collectors and its own border-router data, and then compared what it sent with what the Internet repeated back. The short version: a lot of the Internet is not preserving the field as advertised.

BGP UPDATE
  prefix: test route
  AS_PATH: unchanged path history
  ORIGIN: IGP | EGP | INCOMPLETE

operator shortcut:
  rewrite ORIGIN to IGP
  keep AS_PATH looking the same
  improve tie-break position
The interesting part is that the path can look structurally similar while one old preference signal gets cleaned up in transit.

The Field Is Older Than Its Meaning

RFC 4271 defines ORIGIN as a well-known mandatory BGP path attribute with three values: IGP, EGP, and INCOMPLETE. That made more sense in a world where the old Exterior Gateway Protocol still mattered and BGP was closer to its original transition period. Modern Internet routing no longer uses EGP in that way, but the attribute stayed in the protocol and in vendor best-path behavior.

That is where the weirdness starts. If a route with ORIGIN set to IGP is preferred over one marked EGP or INCOMPLETE after higher-priority comparisons have tied, then changing the field can become an economic tool. A transit provider does not have to shorten the AS path. It can make the route look more attractive at a tie-break point that many networks still honor.

When old metadata still affects selection, it stops being documentation and becomes leverage.

What Cloudflare Measured

Cloudflare's experiment announced three IPv4 and three IPv6 prefixes, each carrying a different ORIGIN value, from all of its peering locations using BGP Anycast. After propagation, it withdrew the prefixes to trigger path hunting and expose more alternate paths. The analysis used public BGP collector data from RIPE RIS and RouteViews through BGPKIT, plus local BMP data from Cloudflare border routers.

The useful detail is that Cloudflare could isolate direct peers. If Cloudflare sent a route with one ORIGIN value and then observed a different value through a direct peer path, the peer had changed it. That makes the measurement more concrete than a vague complaint about routing drift.

The reported scale is not small. Cloudflare says 26 percent of the top 50 ASes and 20 percent of the top 100 ASes in its data manipulated ORIGIN. More important, it found that a large share of observed unique paths ended up reset to IGP: 70 percent for IPv4 and 67 percent for IPv6 in the experiment.

The Path-Selection Effect

The manipulation was not just cosmetic. Cloudflare compared converged routing-table state against an IGP control group to see how the rewrites changed best-path outcomes. In IPv4, it found 110 AS_PATHs out of 539 traversed Tier-1 networks, and ORIGIN rewriting won 12 additional paths for rewriters that otherwise would have gone through networks preserving ORIGIN. In IPv6, the effect was stronger: 33 more paths, a 40 percent increase.

That is the operational punchline. Rewriting ORIGIN can steer traffic toward large transit networks and away from alternatives that leave the attribute alone. The technical field becomes a competitive distortion. Networks that follow the old behavior honestly can lose path selection to networks that normalize everything to the most attractive value.

For operators, this is exactly the kind of routing behavior that is hard to see from inside one network. The route table tells you what path won. It does not always tell you which upstream quietly polished a legacy attribute before the decision got made.

Why Deprecation Keeps Coming Up

Cloudflare argues there is no valid technical reason to require ORIGIN rewriting, and that the attribute should no longer drive route selection. That lines up with prior IETF discussion. An expired Internet-Draft, Deprecating the BGP ORIGIN attribute, said the original meaning had been out of use for years while the field remained high in best-path preference and was being used inconsistently to manipulate route preference.

There is a practical constraint: ORIGIN is still mandatory in BGP, so nobody gets to delete it from the protocol tomorrow. The cleaner near-term move is to stop treating it as a meaningful best-path input. Keep it parseable for compatibility. Stop letting it decide winners where more relevant routing policy should speak.

keep for compatibility:
  accept ORIGIN in BGP updates
  preserve parser behavior

remove from trust:
  do not let ORIGIN rewrite win routes
  prefer explicit policy and modern signals
  make route selection less gameable
The conservative fix is not to break BGP. It is to take an obsolete signal out of the steering wheel.

The Operator Lesson

This is not only a standards argument. It is a monitoring problem. Networks should know whether their upstreams rewrite ORIGIN, whether their routers still use it in best-path selection, and whether policy is relying on a field whose semantics no longer match the modern Internet.

  • Audit best-path behavior for ORIGIN preference in deployed router platforms.
  • Compare received routes from multiple peers when path selection looks unexpectedly sticky.
  • Treat ORIGIN as weak evidence, not as a trustworthy statement about route quality.
  • Watch vendor defaults as implementations respond to the deprecation argument.

The larger lesson is familiar: protocol compatibility can outlive protocol meaning. A field that remains mandatory for wire compatibility may still deserve to lose authority inside decision logic. BGP has enough hard problems without giving obsolete metadata another vote.

The Takeaway

Cloudflare's ORIGIN research is a reminder that Internet routing is not only about reachability. It is about incentives embedded in old machinery. If a legacy attribute can be rewritten to win traffic, somebody will rewrite it. If honest networks lose because they preserve it, the protocol has made honesty a disadvantage.

The answer is not panic. It is deweighting. Keep BGP compatible, but stop pretending every historical attribute still deserves operational trust. ORIGIN can remain a field in the update. It should not remain an alibi for choosing a worse path.

Sources