What is eBGP?

Understanding eBGP

eBGP (External Border Gateway Protocol) is the variant of BGP used to exchange routing and reachability information between routers in different autonomous systems (AS). It is the protocol that interconnects independent networks across the internet, allowing each AS to advertise the IP prefixes it can reach to its neighbors in other organizations.

eBGP works by establishing TCP sessions on port 179 between peer routers in two different AS numbers. Peers exchange UPDATE messages carrying network prefixes and path attributes, most notably the AS_PATH, which lists every AS a route has traversed. Routers use AS_PATH for loop prevention and path selection. By default eBGP peers must be directly connected (TTL of 1), and the AS_PATH is prepended with the local AS number on each advertisement, distinguishing eBGP from iBGP, which runs inside a single AS and does not modify AS_PATH.

eBGP matters because it is the trust boundary of internet routing, and that trust is largely implicit. A misconfigured or malicious AS can advertise prefixes it does not own, causing route hijacking that redirects or blackholes traffic. Famous outages have stemmed from accidental eBGP leaks. Securing eBGP with prefix filtering, maximum-prefix limits, RPKI origin validation, and TTL security (GTSM) is essential to prevent hijacks and route leaks.

For example, an enterprise multihomed to two ISPs runs eBGP sessions with each provider, advertising its own public /22 to both. Inbound and outbound traffic is steered using attributes like local preference and AS_PATH prepending. The enterprise applies prefix filters so it never accidentally re-advertises one ISP's full routing table to the other, which would otherwise turn it into an unintended transit path.