There is a field in every BGP route announcement that the protocol’s own specification says nobody should touch after it is set — and according to a new measurement study from Cloudflare, most of the internet’s traffic is flowing over paths where somebody touched it anyway. In research published July 24 by Cloudflare engineers Iliana Xygkou and Bryton Herdes, the company announced test prefixes with known ORIGIN values from its global network and then watched what came back through public route collectors. The result: roughly 70% of the unique IPv4 paths observed — and 67% of IPv6 paths — carried an ORIGIN value different from the one Cloudflare originally set.
That is not a rounding error. It is quiet, widespread rule-bending by the networks that carry your packets, and it has a measurable effect on which roads traffic takes across the internet.
The attribute nobody was supposed to modify
ORIGIN is one of BGP’s mandatory path attributes — it must be present in every prefix announcement. It records how a route was injected into BGP in the first place, and it has exactly three possible values: IGP (0), meaning the route is interior to the originating network; EGP (1), a historical value referring to the long-obsolete Exterior Gateway Protocol; and INCOMPLETE (2), meaning the route came from an unknown or external source.
The rule for everyone else is spelled out in RFC 4271, the core BGP-4 specification: the ORIGIN attribute is generated by the speaker that originates the route, and its value “SHOULD NOT be changed by any other speaker.”
The reason anyone bothers changing it anyway comes down to where ORIGIN sits in BGP’s best-path selection. When a router holds two routes to the same prefix with equal Local Preference and equal AS_PATH length, the tie-breaker it reaches for next is ORIGIN — and lower wins. A transit provider that rewrites INCOMPLETE or EGP to IGP on the routes it passes along makes its own path look slightly more attractive to downstream networks. More preferred paths mean more traffic, and for a transit provider, more traffic means more revenue. Cloudflare’s post is blunt about the incentive structure, calling route selection “a revenue-driven arms race.”
Across all routes visible from the public collectors run by RIPE RIS and RouteViews, Cloudflare notes that 89.8% already carry IGP, 3.5% carry EGP, and 6.7% are INCOMPLETE — so more than 10% of routes have a value that a self-interested intermediary could profitably “improve.”
How Cloudflare caught the rewriters
The experiment design is what makes this study worth reading rather than another anecdote from a network operators’ mailing list. Cloudflare announced three IPv4 and three IPv6 test prefixes — one for each ORIGIN value — from all of its peering locations via BGP anycast. Because the company controlled the originating router, it knew with certainty what value every observer should see. It then withdrew the prefixes to trigger BGP’s path-hunting behavior, which exposes additional alternate paths and gave the team more chances to spot altered values.
To process the data, the team used the BGPKIT toolkit to parse BGP update messages from every public collector at RIPE RIS and RouteViews, plus BMP telemetry from Cloudflare’s own border routers — deliberately analyzing updates rather than routing-table snapshots to capture routes during both announcement and withdrawal.
The two-hop results are the cleanest. Among 352 direct IPv4 peers, any ORIGIN change could be attributed to exactly one network. About 10% of direct peers rewrote the ORIGIN to IGP. A handful went the other direction — three networks forced EGP and four forced INCOMPLETE regardless of the advertised value, apparently to deprioritize those routes. One network engineer contacted by Cloudflare confirmed their AS rewrites ORIGIN to EGP on routes learned from peers and providers so that customer routes win ties instead. The IPv6 numbers, from 315 direct peers, told nearly the same story — with the wrinkle that two networks rewrote ORIGIN only for IPv4 and not IPv6, implying inconsistent configuration between address families.
Extending the analysis to longer paths with an iterative attribution algorithm, Cloudflare classified 606 of the 802 visible ASes (75.6%) — and found 64 of them, about 10.6%, rewriting ORIGIN to IGP.
Small percentage, enormous footprint
Ten percent sounds survivable until you look at who is doing it. Six of the 16 Tier-1 networks — the transit-free carriers at the top of the internet hierarchy — manipulate the ORIGIN value, matching earlier community findings presented by James Bensley at RIPE 91 and studied regionally by Celsa Sánchez at LACNIC 45. Weighting by CAIDA’s AS Rank, 26% of the top 50 networks and 20% of the top 100 rewrite the attribute. One Tier-1 was found rewriting ORIGIN on routes learned from peers while preserving it on customer routes — a configuration that only makes sense as a traffic-attraction strategy.
Because the rewriters are concentrated at the top of the hierarchy, their behavior dominates what the rest of the internet sees: hence the 70% of unique IPv4 AS_PATHs carrying a reset value. And it changes real routing decisions. Comparing converged routing state for its test prefixes, Cloudflare found that resetting ORIGIN to IGP won the rewriting networks 12 additional best paths in IPv4 (an 18% gain) and 33 more in IPv6 (40%) — paths that would otherwise have gone through networks that follow the RFC. Traffic, in other words, is being siphoned toward large Tier-1 carriers and away from compliant alternatives by a one-line router policy.
Cloudflare’s conclusion: retire the attribute
The post ends with a pointed question — does ORIGIN still have a meaningful role on the modern internet? — and answers it: no. Since EGP-the-protocol has been obsolete for decades and the attribute’s inconsistent treatment now mostly rewards whoever bends the rules, Cloudflare argues the attribute should stop influencing path selection entirely. As a pragmatic first step, it suggests BGP implementations set ORIGIN to IGP on all routes received and advertised, which would neutralize the tie-breaker without a disruptive protocol change. The company also wants the IETF conversation reopened, pointing to the expired draft “Scrubbing BGP ORIGIN Attribute” as one possible starting point.
For network operators, there is an uncomfortable practical takeaway in the meantime: if your traffic engineering depends on ORIGIN surviving across the internet, it doesn’t. Any policy built on that assumption is already being silently overridden somewhere along the path.
Bottom line: Cloudflare’s controlled experiment puts hard numbers on something operators have grumbled about for years — ORIGIN rewriting is not a fringe misconfiguration but standard practice among the internet’s largest carriers, it demonstrably shifts best-path selection in their favor, and the most realistic fix on the table is to make the attribute irrelevant altogether.
