What the investigation found
Border Gateway Protocol is the routing protocol of the internet. It carries path attributes that influence how Autonomous Systems choose the best path for a prefix. ORIGIN is one of the well-known mandatory attributes, and it must be present in every BGP prefix. According to the spec, ORIGIN should not be modified by any router after being set by the originating one.
Cloudflare took an investigative look using its unique position on the internet, and what it found was dramatic. About 70% of observed paths in numerous vantage points have an ORIGIN value different from what the originating Autonomous System actually set. The manipulation has a significant impact on how traffic is forwarded.
What ORIGIN is and why anyone would change it
The ORIGIN attribute indicates how a route was injected into BGP, not to be confused with the origin AS that announced the route. It has three possible values. EGP, a historical value indicating the route was learned via the old EGP protocol, which is obsolete. INCOMPLETE, which means the route was redistributed into BGP from another routing protocol. IGP, the most common, meaning the route was learned via an interior gateway protocol.
The path selection algorithm evaluates ORIGIN after Local Preference and AS_PATH length. Lower ORIGIN value wins, with IGP beating EGP beating INCOMPLETE. Among total observable routes from public BGP collectors, 89.8% have ORIGIN set to IGP, 3.5% to EGP, and 6.7% to INCOMPLETE. EGP is meant to be deprecated, and INCOMPLETE is a minority share, but more than 10% of routes have an EGP or INCOMPLETE value, and that 10% is exactly where the manipulation matters.
Why ASes manipulate it
The guidance in the spec is to not modify the ORIGIN attribute. Due to its early evaluation in the route selection process, the attribute has presented an attractive option for ASes that want to alter route preferences and divert traffic either through or away from their networks.
Consider a simple case. AS64501 announces a prefix with ORIGIN set to INCOMPLETE and propagates the announcement to its customers AS64502 and AS64503. Normally, both customers prepend their own AS in the AS_PATH and forward to their common customer AS64504, preserving the INCOMPLETE value. But to increase the likelihood of their route being selected over the competitor's, AS64503 modifies the ORIGIN to IGP. AS64504 then receives two routes: one with ORIGIN INCOMPLETE from AS64502, and one with ORIGIN IGP from AS64503. The latter is preferred, even though it is not the route the originating AS actually set.
Why this matters in practice
The manipulation is invisible to most operators because ORIGIN is rarely inspected. The path selection algorithm uses it, but no one is auditing whether the ORIGIN value on a received route is the one the originator announced. The result is that internet routing decisions are being influenced by an attribute that doesn't reflect the reality of how the route was injected, and the influence is large enough to shift traffic in measurable ways.
The implications are not just theoretical. Cloudflare's data suggests that the manipulation is widespread enough to affect how traffic flows to a significant fraction of internet prefixes. Operators who care about the path their traffic takes should be looking at ORIGIN as part of their routing hygiene, and the spec's guidance to not modify the attribute deserves more attention than it has historically received.
The lesson is broader than BGP. Any routing attribute that influences path selection is a candidate for manipulation by an AS that wants to influence its traffic. The fact that the attribute is supposed to be unchanged doesn't make it unchanged. The internet is a trust system, and trust systems get gamed.