The basics
An AS path such as 9498 13335 reads from left (the network closest to the observer) to right (the origin). Here, AS13335 originated the route and AS9498 passed it on.
Spotting the origin
The rightmost ASN is the origin — the network claiming the prefix. If that is not who you expect, investigate.
Upstreams and peers
The ASN just before the origin is usually the network the origin connects to: a transit provider or a peer. Looking at many paths tells you which upstreams a network uses.
Prepending
A path like 6939 64500 64500 64500 shows the origin repeated three times. That is prepending, used to make a path look longer and less attractive.
Red flags
- A private ASN (64512–65534) in the middle of a public path.
- An origin that does not match the prefix registration.
- A small network appearing between two large ones, which can indicate a route leak.
Practise
Use the looking glass on a well-known prefix and compare paths from different vantage points. Then try our BGP security check to see automated anomaly detection.
