Static routes, dynamic routing, and autonomous systems

Two ways a route gets into the table

Static routing means a human typed the route. It is exact, predictable, and costs no bandwidth or CPU.

ip route add 10.99.0.0/16 via 10.20.30.9 dev eth1

Dynamic routing means routers run a protocol, tell each other which prefixes they can reach, and compute their own tables. It costs some traffic and CPU, and it earns that back the moment something changes.

The rule of thumb in practice: static routes for the edges and for deliberate exceptions, dynamic routing anywhere a second path exists. If there is only one way out, a dynamic protocol has no decision to make.

How dynamic protocols think

There are two families, and they differ in what each router knows.

Distance vector. Each router tells its neighbors only "I can reach prefix P at cost N". A router adds its own cost and passes it on, so it trusts its neighbors' summaries without seeing the topology. Simple, and slow to converge, with a classic failure where two routers count each other's stale information upward. RIP is the textbook example, with a hop count limit of 15 to bound the damage.

Link state. Each router floods a description of its own links to everyone in the area. Every router therefore builds an identical map of the whole area and runs Dijkstra's shortest path algorithm on it locally. Convergence is fast because nobody is relaying second hand summaries. OSPF (open shortest path first) is the standard example.

OSPF's metric is cost, derived from bandwidth, and the path with the lowest total cost wins.

That floor is why modern deployments raise the reference bandwidth, otherwise a 1 Gbps and a 100 Gbps link look identical. OSPF also splits large networks into areas joined by a backbone area 0, so a change in one area does not force every router on the network to recompute.

Autonomous systems, and why BGP is different

An autonomous system (AS) is one network under a single routing policy, identified by an ASN, a 32 bit autonomous system number. An ISP is an AS. A large university is an AS. A cloud provider is several.

That gives two scopes of routing, and the names follow from it:

BGP (border gateway protocol) is the only exterior protocol in use, and it is the protocol that holds the internet together. Its difference from OSPF is not technical detail, it is purpose. OSPF asks "which path is fastest". BGP asks "which path am I willing to use, and which paths am I willing to tell others about". That is a business question.

BGP advertises a prefix along with attributes, and the important one is the AS_PATH, the list of autonomous systems the advertisement crossed.

prefix 198.51.100.0/24  AS_PATH: 64500 64501 64512

Read right to left. AS 64512 owns the prefix, it told AS 64501, which told AS 64500, which told you. The path serves two purposes. It is a rough distance metric, shorter is usually preferred, and it is loop prevention, because a router that sees its own ASN in the path discards the advertisement immediately.

Policy beats path length, though, and that is the part that surprises people. An ISP prefers a route learned from a customer (who pays) over one from a peer (settlement free) over one from a provider (who charges), even when the customer path is longer. Preference attributes encode that, and this is why internet paths are frequently not geographically sensible.

Two BGP flavors, and one failure mode worth knowing

- eBGP, external BGP, runs between routers in different ASes. It is where policy is applied. - iBGP, internal BGP, runs between routers inside one AS, so that every border router learns the prefixes the other borders heard. It carries external routes across the AS while OSPF handles the internal topology.

BGP trusts what it is told. If an AS announces a prefix it does not own, and its neighbors accept the announcement, traffic for that prefix flows to the wrong place. That is a route hijack, and it has taken large services offline for hours. Because longest prefix match wins, announcing a /24 out of somebody's /16 is enough to steal just that slice.

Defenses are filtering and cryptographic proof of ownership rather than a change to BGP itself:

- Prefix filters on every session, so a neighbor can only announce what it is authorized to announce. - RPKI, a signed registry mapping prefixes to the ASes allowed to originate them, letting a router mark an unauthorized announcement invalid.

Convergence is the other operational reality. A withdrawal has to propagate across thousands of ASes, so global BGP convergence takes tens of seconds to a few minutes, not milliseconds. That is the real reason a large outage keeps producing errors for a while after the fix is in place.