Four classes of routing attack still escaping validation, new survey warns

On 20 May 2025, a Border Gateway Protocol (BGP) update carrying a corrupted Prefix-SID attribute, an optional and transitive field identified by code 40, originated from an Autonomous System (AS) in the Asia Pacific region. An AS is a network or group of networks under a single technical administration, identified by a unique number, and BGP is the protocol those networks use to exchange information about how to reach every destination on the internet. What happened next was neither a traditional route hijack nor a route leak. Cisco IOS-XR and Nokia SR-OS did what RFC 7606 recommends: they discarded the malformed attribute and moved on. Juniper JunOS passed the message along intact. Arista routers that received it reset their BGP sessions. Route servers at several Internet Exchange Points (IXPs), the physical locations where different networks connect and exchange traffic, relayed the attribute onward without filtering it. Within ten seconds, the global routing system saw more than 150,000 updates, and BGP sessions flapped at Starlink, Disney, Zscaler and ByteDance, among others. Arista later changed this behaviour in EOS 4.28.11 and later releases.

Nothing that the Resource Public Key Infrastructure (RPKI), the main cryptographic system for validating route origins, is designed to check was violated anywhere in that chain. Operators often struggle to classify the event: not a hijack, not a route leak, just something odd with an attribute. That gap was one of the starting points for a new survey, published open access in IEEE Communications Surveys & Tutorials under CC BY 4.0 (DOI: 10.1109/COMST.2026.3714569). The authors, from Sapienza University of Rome, Namex (Rome IXP) and the Italian National Cybersecurity Agency (ACN), revisit the open questions posed in a 2011 routing security survey by Huston, Rossi and Armitage, and ask what has changed in 15 years. The answer includes a taxonomy that surprised even them.

The survey organizes routing attacks into four macro-categories and eight micro-categories, providing consistent naming so each class can be mapped to the defences that address it. The first macro-category is route manipulation, which covers unauthorized changes to prefix or path information. It includes prefix hijacking (PRH), with complete, incomplete, interception and abusive variants, and AS_PATH manipulation (ASM), covering poisoning, forged origin injection, path shortening and path extension. The second is routing consistency, attacks on the stability of the routing table rather than its contents. This includes state volatility (VOL), such as disruptive flapping, flooding through oscillation, amplified churn injection and delayed convergence, and prefix deaggregation (DEG), which can be malicious, careless, exploitative or a fragmentation flood. The third is policy violation, which includes routing leaks (RLK) in the four directions defined in RFC 7908, and policy manipulation (POL) via Local Preference, Multi-Exit Discriminator (MED), AS_PATH length and selective propagation. The fourth is session-based attacks, specifically attribute-based session reset (ATR), where malformed optional transitive attributes, vendor-specific attribute exploitation or error-handling policy abuse can reset BGP sessions. The May 2025 event belongs in this fourth category.

Laying existing defences over this structure reveals a lopsided picture. Prefix hijacking has seen the most progress, but with important caveats. Internet Routing Registries (IRRs) and RPKI provide origin validation, and Route Origin Authorization (ROA) coverage keeps climbing. However, coverage is not enforcement: a longitudinal study across more than 28,000 ASes found that 36.2% do not implement Route Origin Validation (ROV) at all, and only 12.3% achieve full protection. Permissive maxLength settings can widen the attack surface rather than narrow it, which is why RFC 9319 was published. Abusive hijacking of unannounced address space remains feasible where objects are not maintained. AS_PATH manipulation is partially addressed in principle by BGPsec, a protocol that cryptographically signs the path an announcement takes, but it is essentially undeployed. A single non-adopting AS in the path strips the security information, making partial deployment close to worthless. Routing leaks show the most encouraging movement: Autonomous System Provider Authorization (ASPA) objects, which let networks list their legitimate upstream providers, have been publishable in Regional Internet Registry repositories since December 2025, with 1,314 registered at the time of writing. Analysis suggests deployment by strategically positioned ASes could cut the number of ASes affected by leaks by up to 96%. The Only to Customer (OTC) attribute and the Down Only community, both building on roles defined in RFC 9234, could suppress over 98% of multi-hop leaks if adopted selectively across well-connected Tier-1 and Tier-2 networks.

In sharp contrast, the remaining four classes, state volatility, prefix deaggregation, policy manipulation and attribute-based session reset, have no cryptographic answer at all. Not a partially deployed one, none. They are addressed only with operational hardening, control-plane policing, max-prefix limits, prefix-length filters, policy hygiene, robust error handling and attribute filtering at route servers. All of these are local, reactive and unverifiable by the party that suffers the consequences. There is no equivalent of checking a ROA and dropping invalid announcements, and no global state anyone can query. When an operator asks whether they are protected against a fragmentation flood from a peer, the honest answer is that they have a max-prefix limit and a hope.

Two shifts have made these uncovered classes matter more than they used to. The first is IPv6 arithmetic. An IPv6 address block, the newer and vastly larger internet addressing scheme, can be subdivided much more aggressively than IPv4. Within a single /29 allocation, up to 524,288 distinct /48 blocks can be generated and announced. The global IPv6 BGP table currently holds around 219,000 entries. One allocation, one router, and the table more than doubles. The defence, a static max-prefix threshold, also breaks legitimate growth if set too tight, which is precisely why operators set it loosely. The second shift is that the partial success of origin validation redistributes attacker attention. As ROV enforcement grows, the return on hijacking a prefix falls, while the return on the classes nobody validates rises. This is not a claim about anyone's intentions; it is the ordinary economics of a control that covers one thing well.

Revisiting the 2011 open questions, four remain live. First, can a relying party validate not only that the AS_PATH in an update matches the path the advertisement travelled, but that the network's actual forwarding state is aligned with it? Pat