BGP is the protocol that decides where your traffic actually goes, and it runs almost entirely out of sight. It doesn’t emit a red light when something goes wrong. It just quietly starts sending packets down the wrong path — often someone else’s wrong path — and the first sign you get is latency, packet loss, or a customer on the phone. 2025 was a hard year for exactly this failure mode, and the lesson is the same every time.
A bad year for a fragile layer
A short recap of what the industry saw, reported as public events:
- On 26 December 2025, an accidental BGP route leak from an undersea-cable operator (WIOCC) knocked out much of South Africa’s internet — a single mis-announcement rippling out to millions of users.
- In May 2025, a malformed BGP attribute triggered widespread session resets and routing instability across major router platforms. The trigger was one attribute; the blast radius was global.
- In April 2025, an operator in India leaked more than 30,000 prefixes, disrupting traffic for over an hour as networks worldwide briefly believed a better path existed where none did.
- In January 2026, a short IPv6 route leak dropped roughly 12 Gbps of traffic before it was caught.
Different operators, different regions, different root causes — but one shared shape. None of these were a device going down. Every device stayed “up.” What changed was the information the network was carrying about how to reach the rest of the world, and no up/down check is built to see that.
Why monitoring is blind here
The whole point of BGP is that reachability can shift without anything failing. A leak works precisely because the routers are healthy and happily accepting a new announcement. Your interface counters look normal. Your ping to the next hop succeeds. Meanwhile your traffic is egressing through a peer it should never touch, or being pulled toward an AS that leaked your prefixes.
To catch this you have to look at the attributes that actually drive path selection:
- AS-path — did it lengthen, or suddenly route through an AS that has no business being there?
- Local-preference — did an internal policy change quietly re-weight your egress?
- Communities — were tags added or stripped that change how peers treat your routes?
- Next-hop and prefix set — are you announcing or accepting prefixes you shouldn’t be?
These are the fingerprints of a route leak. A dashboard of green tiles contains none of them.
Depth plus history is how you catch it fast
Seeing the attributes isn’t enough on its own — you also need to know what they looked like before. The question during an incident is never “what does the path look like now?” It’s “what changed, and when?” Without a history you’re reconstructing the past from memory and mailing-list threads. With one, you diff two points in time and the offending change stands out in seconds: this prefix’s AS-path gained a hop at 02:14, this community was stripped, this local-pref flipped.
That’s the capability Phantom is built around for BGP. It continuously tracks path attributes across a multi-vendor network and keeps the history, so a path change becomes something you can explain — and prove — rather than something you chase. New to the protocol or the failure mode? Start with our primers on how BGP works and BGP route leaks, then see how Phantom applies it in BGP assurance.
2025 made the point loudly: the fragile, invisible layer is the one worth watching most closely. See it on your own paths — book a demo.