Cloudflare maps early route leak defenses in BGP
Cloudflare says early deployment of RFC 9234 is visible on the public Internet, but still sparse. Its measurements found 67 directly peered autonomous systems sending the Only to Customer attribute, a signal used for BGP route leak prevention. The company also says two Tier-1 networks, GTT and Arelion, stripped that attribute in tests, weakening protection for networks multiple hops away. Arelion has since begun preserving the attribute for Cloudflare's experiment prefixes, while GTT configurations still removed it at the time of the report.BGP Roles move routing intent into the protocol
RFC 9234 is designed to reduce BGP route leaks by putting business relationship intent into BGP itself. Cloudflare describes route leaks as announcements that travel beyond their intended scope, such as a route learned from a provider or peer being sent back up to another provider or sideways to another peer.The standard introduces BGP Roles and the Only to Customer attribute, known as OTC. A role declares whether an external BGP session is provider, customer, peer, route server or route server client, while OTC marks routes that should only continue downward toward customers. If a router understands OTC, it can reject a leaked route without relying only on manually written routing policies.
That distinction matters because older defenses depend heavily on each network maintaining correct filters and relationship data. RFC 9234 does not remove the need for operational care, but it gives routers an in-band signal that can stop some leaks before they propagate widely.
Cloudflare measured early adoption from peer signals
Cloudflare used its global peering footprint to look for direct evidence of RFC 9234 adoption. By monitoring BGP Monitoring Protocol feeds from its routers, it checked which directly connected peer autonomous systems sent OTC values equal to their own ASNs.Across the past three months of BMP data, Cloudflare found 67 ASes that set the OTC attribute. The company says route servers stood out among adopters, partly because open-source BGP implementations tend to add new protocol features faster. It also observed a visible share of compliant ASes owned by individuals, which Cloudflare suggests may be connected to personal use of open-source routing software.
Public collector data gave a more ambiguous picture. Cloudflare's analysis of RouteViews and RIPE RIS data produced 36 ASes that were potentially RFC 9234-compliant, but the company cautioned that the true number needs more investigation because OTC can be added either on egress or on ingress.
OTC stripping appeared in Tier-1 transit paths
Cloudflare then tested whether networks were removing OTC even though it is an optional transitive BGP attribute. The company announced one IPv4 prefix and one IPv6 prefix with OTC set to 13335, Cloudflare's ASN, from all of its peering locations using BGP Anycast.After confirming global propagation, Cloudflare withdrew the prefixes to trigger path hunting and reveal more routes. It parsed update messages from RIPE RIS, RouteViews and its own BMP data. In its first direct check of AS paths in the form ASX AS13335, Cloudflare found six ASes dropping OTC, including two Tier-1 networks: AS3257, GTT, and AS1299, Arelion.
An iterative method identified nine more ASes dropping the value. Cloudflare says 33.1% of IPv4 routes and 17% of IPv6 routes to its test prefixes had OTC removed. Although the number of stripping ASes appeared small, the reach of top-tier transit meant the practical effect was much larger.
Arelion and GTT dominated absent-OTC observations
The two Tier-1 networks accounted for most of the paths where Cloudflare expected OTC to remain visible but found it absent. Cloudflare says AS1299 and AS3257 appeared together or separately in 96.6% of IPv4 OTC-absent paths and 92.9% of IPv6 OTC-absent paths, with Arelion responsible for the larger share of those observations.The behavior was not identical across both networks. Cloudflare says GTT consistently dropped the OTC attribute in the relevant measurements. Arelion's behavior was inconsistent, with 71.4% of IPv4 and 40.7% of IPv6 AS paths missing OTC when AS1299 was the next hop after AS13335.
Cloudflare says it contacted both companies and that they confirmed OTC stripping as part of defensive practices that followed earlier BGP error-handling incidents. According to Cloudflare, Arelion later rolled out configurations to preserve OTC for the experiment prefixes, while GTT configurations still caused OTC removal at the time of publication.
Why transitive OTC propagation matters
OTC only helps distant networks if it survives transit. Cloudflare points to the BGP rule that optional transitive attributes should be passed along when a route is accepted and forwarded, even if the receiving router does not recognize the attribute.Operators have had reasons to be cautious. Cloudflare notes that malformed transitive attributes historically caused remote session resets before improved error handling in RFC 7606, and that a recent malformed OTC issue caused resets in some BGP implementations. Those incidents help explain why some networks may have filtered unfamiliar attributes as a defensive measure.
The trade-off is that stripping OTC weakens route leak prevention for early adopters. During partial deployment, many networks will not yet configure BGP Roles, so preserving the attribute through large transit providers gives compliant routers multiple hops away a chance to identify and reject leaked routes.
Operational implications for network operators
Cloudflare's results show that RFC 9234 is moving from specification to production use, but deployment is still early. Strict mode, which rejects sessions when a neighbor does not advertise a role, is described as unrealistic for most networks at current adoption levels.The more practical path is gradual role configuration on external BGP sessions where the relationship is clear. Cloudflare says roles should not be configured on a single session that carries multiple relationship types, such as provider-to-customer for some prefixes and peer-to-peer for others. In those cases, the standard expects operators to separate the relationships into distinct sessions or fall back to more complex per-prefix policy.
Cloudflare says it has begun a gradual deployment of RFC 9234 configurations across its global router fleet. For operators, the immediate implication is to check vendor support, preserve OTC rather than scrub it, and plan role changes carefully because applying roles can require BGP session resets.
Conclusion
Cloudflare's study gives a useful early measurement of RFC 9234 adoption and a warning about partial deployment. The standard can make route leak prevention more automatic, but only if networks configure roles and large transit providers allow OTC to pass through.The finding that two Tier-1 networks stripped OTC is significant because a small number of central ASes can affect many observed paths. Arelion's reported change suggests the issue can be corrected through coordination. GTT's remaining stripping behavior, as described by Cloudflare, shows why operational defaults at major networks will shape how quickly RFC 9234 becomes effective at Internet scale.
Sources
Editorial Team - CoinBotLab