Summary

  • Bryton Herdes’s team announced a test prefix from a BGP session whose neighbor AS was 13335, but placed a different Cloudflare-owned AS, 402542, first in the advertised AS_PATH. Seven of fourteen tested Tier-1 networks accepted the mismatch.
  • The receiving operator controls this check. Ordinary eBGP sessions can require the first AS in a route to match the neighbor; a transparent exchange route server needs a documented, narrow exception.

The route arrived from AS13335. Its first written AS was 402542. That is the equivalent of a courier arriving at the gate with one badge on the truck and another on the manifest. Bryton Herdes’s team did this on purpose. The response was less reassuring: seven of fourteen Tier-1 peers in its original test report accepted and installed the route.

Herdes presented the result at NANOG 98 on 20 October. His original slides show the export policy prepending AS402542 to a path sent from AS13335. The origin at the far end of the path still looked legitimate. Origin validation asks whether that origin may announce the prefix; it does not compare the leftmost AS to the adjacent BGP peer. A sufficiently stripped path also leaves little for provider-authorization checks to dispute. The receiving session already knows the peer’s ASN. It can compare that number with the first AS before the route enters its table.

The team’s experiment deliberately crossed that boundary with its own test prefix and its own ASN. Seven Tier-1 networks rejected the mismatch; seven accepted it. Those counts belong to the selected peers and the test period. The finding exposes a configuration surface, not a recorded outside hijack. Herdes’s report also says the team abandoned a plan for continuous probes after discovering that some peers reset their BGP sessions on malformed paths instead of treating the route as withdrawn. Measurement itself had an operational price.

There is a real exception, and it belongs in a small box. An Internet exchange route server relays routes without adding its own ASN to AS_PATH. RFC 7947 tells route-server clients to allow the first-AS check to be disabled for that peer. Apply that exception to the transparent route-server session; keep the check on ordinary external peers. A global off switch turns one useful exception into an invitation for every neighbor.

Herdes’s slide table shows that implementation defaults differ. That makes the receiving operator’s inventory more useful than a vendor logo: list external BGP neighbors, identify actual route servers, inspect the effective first-AS setting on each session, then send a controlled mismatched test route where the operator has authority to do so. Look for rejection in the received-route evidence and check whether a malformed update resets the session. The first AS is a small field with a large job. It says who handed you the route. If the session refuses to check, a polished origin can walk in carrying someone else’s name.

Sources: NANOG 98 session · Herdes’s original slides · team’s original test report · RFC 7947.