BGP Vortex

How it works

Setup and oscillation cycle

The problem

BGP does not guarantee convergence.

In practice, convergence follows from the Gao–Rexford conditions: no AS prefers a peer or provider route over a customer route, and routes learned from peers or providers are exported only to customers.

Many large networks let customers attach BGP communities that change the provider's route selection or export for their routes.

Root cause

Two widely offered communities make three Gao–Rexford-compliant providers oscillate indefinitely.

Local preference lowering. The provider ranks the customer's route below routes learned from peers.
Selective NOPEER. The provider exports the route only to selected peers.

Results

Topology analysis, Tier-1 probing and testbed experiments

Support for both communities was confirmed at three Tier-1 providers that form a vortex, testing each community separately.

UPDATE messages start a vortex, one per provider, for a prefix the adversary owns, sent from a single BGP speaker.

340

possible vortices among 21 of the top-30 ASes, 30.4% of the 1,119 peering triangles among the top 30. The median AS is part of 58, the maximum 86.

>96%

of all ASes are in the customer cone of at least one of these 21 ASes (73,743 of 76,564).

40 s

maximum delay of legitimate route advertisements caused by a single vortex in a 7-AS testbed. BGP processing could not keep up, and the targeted prefixes had data-plane outages.

3 / 3

router implementations tested oscillated persistently.

Cisco XRv9000 BIRD FRR

Update rate

Updates per second at the median customer AS

Theoretical estimate with all 340 vortices active, one prefix each. Log scale.

Baseline, APNIC R&D (2024) 2.3 /s

Vortex, FRR (0.15 s per cycle) ≈5,300 /s

Vortex, BIRD (≈40 cycles/s) ≈32,000 /s

Distribution of updates per cycle across customer ASes

801 median 55 min 991 max

Rates are the median 801 updates per cycle times the cycle rate measured with FRR or BIRD in the testbed. Each additional prefix adds as many updates again, and providers commonly accept up to 100 prefixes per customer, enough for tens of thousands of updates per cycle.

Defenses

Why existing defenses fail

RPKI and BGPsec validate origin and AS path. The adversary announces its own prefix with a genuine path.
Route aggregation needs identical path attributes, which the adversary avoids with AS-path prepending.
MRAI timers would slow the oscillation, but most operators disable them for faster convergence.
Route flap damping is deployed at about 8% of ASes (lower bound), off by default at major vendors, and not implemented in BIRD.

Mitigation

Safe BGP communities

The paper proposes a framework for deciding which BGP communities and extensions are safe to deploy.

Read the paper (PDF) →

Cite

@InProceedings{fstoeger-usenixsecurity2025,
  title     = {BGP Vortex: Update Message Floods Can Create Internet Instabilities},
  author    = {Felix St\"{o}ger and Henry Birge-Lee and Giacomo Giuliari and Jordi Subir\`{a}-Nieto and Adrian Perrig},
  booktitle = {Proceedings of the USENIX Security Symposium},
  year      = {2025},
  month     = aug,
  url       = {https://www.usenix.org/conference/usenixsecurity25/presentation/stoeger}
}

More research

Ongoing

Setup and oscillation cycle

Topology analysis, Tier-1 probing and testbed experiments

Updates per second at the median customer AS

Why existing defenses fail

Safe BGP communities

On-Demand Path-Aware Backbone

Authenticated Browsing

SA4P

Off-Chain NFT Hijacking