Enforcing the First AS in BGP AS PATHs
Jun 3, 2026Bryton Herdes, Bryce Walters, Mingwei Zhang
Summary
This post details an investigation into route hijacks facilitated by forged BGP AS PATHs. It analyzes specific hijack examples, explains the vulnerabilities in BGP related to First AS checking, and proposes the enforcement of First AS matching the peer AS as a critical security measure. The post also describes an experiment where Cloudflare intentionally violated the First AS rule to measure its acceptance on the internet.
More from the Global Network Expansion trail
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Iran's Internet is partially restored, Cloudflare Radar data shows
- Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptions
- Agents Week: network performance update
- 500 Tbps of capacity: 16 years of scaling our global network