From one network to a network of networks
Until now, routing has felt like a single, tidy problem. In the earlier rung you watched protocols like OSPF and RIP compute the least-cost path across a network graph, where every router cooperates, shares its view honestly, and agrees on one goal: get each packet to its destination as cheaply as possible. That works beautifully inside one organisation, because one organisation owns every router and can tell them all to play nicely together. But the Internet is emphatically not one organisation. It is a loose federation of tens of thousands of independently run networks owned by companies, universities, governments, and content providers who do not trust each other and do not share a single goal.
So the Internet has two layers of routing, not one. Inside each organisation's own network, the cooperative least-cost story from before still holds: that is intra-domain routing, the domain of interior gateway protocols. But the moment a packet needs to cross from one organisation into another, a completely different game begins. The networks involved are run by separate parties with their own interests, and nobody is going to honestly publish their internal map to a competitor. This second layer, routing between independent networks, is called inter-domain routing, and understanding it starts with naming the chunks themselves.
The autonomous system: one chunk, one owner, one policy
Each of those independently run chunks is called an autonomous system, or AS. An autonomous system is a collection of networks and routers under a single administrative control, presenting one consistent routing policy to the rest of the Internet. Your home ISP is an AS. A big university is an AS. Google, Cloudflare, and Netflix each run one or more. The defining idea is in the name: the system is autonomous, meaning it decides for itself how its internal routing works and, crucially, who it will and will not carry traffic for. Think of each AS as a sovereign country with its own internal road network and its own border policy about which neighbours' trucks it lets pass through.
Because the Internet needs to refer to each AS unambiguously, every one gets a globally unique number, its autonomous system number or ASN. These are handed out by the same regional registries that allocate IP address blocks. Originally an ASN was a 16-bit number, capping the world at 65,536 of them, but just like with addresses that proved too few, so the format was widened to 32 bits, giving room for billions. An ASN is to a network what an area code is to a region: a short, official label that lets everyone else talk about 'AS15169' (that one is Google's) without ambiguity. When we draw the Internet's structure, the dots are ASes labelled by their ASNs, and the lines between them are business relationships.
Why this layer is about money, not distance
Here is the single biggest mental shift in this whole rung. Inside an AS, routing optimises a number: pick the path with the smallest total cost. Between ASes, there is no shared cost to minimise, because each AS is a separate business and carrying someone else's traffic costs real money. So inter-domain routing optimises something else entirely: policy and economics. An AS does not ask 'what is the shortest path to this destination?' It asks 'which of my neighbours am I willing to send this traffic through, and which path makes or saves me the most money?' The shortest path is often not the chosen one.
Those money relationships come in a few standard flavours. The most important is the provider-customer relationship: a smaller AS pays a larger one to carry its traffic to and from the rest of the Internet, which is called buying transit. In a provider-customer relationship the customer pays, and in return the provider promises to reach everywhere on its behalf. The other common flavour is peering: two ASes of roughly comparable size agree to exchange traffic between their own customers directly, usually for free, because it saves both of them from paying a provider for that traffic. The whole shape of the Internet falls out of these two relationships, and the next guide draws that shape in detail.
BGP: gluing the autonomous systems together
If every AS keeps its internal map secret and only wants to follow its own policy, what language do they use to talk at the borders? The answer is the Border Gateway Protocol, BGP, the single protocol that holds the entire Internet together. BGP is the way one AS tells its neighbours 'I can reach these prefixes, and here is the sequence of ASes a packet would traverse to get there.' Neighbours take that information, apply their own policy to decide whether they like it, and if they do, pass an updated version on to their neighbours. Run that everywhere and, prefix by prefix, every AS learns how to reach every other.
BGP is a path-vector protocol, and that phrase is worth unpacking. The distance-vector protocols from the earlier rung advertised a destination plus a distance ('I can reach X, cost 4'). BGP instead advertises a destination plus the whole list of ASes along the way ('I can reach prefix X via the path AS65010, AS65020, AS65030'). That explicit list, the AS path, does two jobs at once. It lets an AS apply policy by inspecting exactly whose networks a route crosses, and it instantly prevents loops: if an AS sees its own ASN already in the path, it knows accepting that route would create a circle, so it discards it. No counting to infinity, no guessing about distance, just a readable list of who is in the chain.
A BGP route advertisement, in plain words: Prefix: 203.0.113.0/24 (a block of addresses) AS-PATH: 65030 65020 65010 (read right-to-left: who to traverse) Reading it: "To reach 203.0.113.0/24, send the packet toward me, and it will pass through AS65020, then AS65010, which owns the block." If AS65030 ever sees 65030 already in an AS-PATH it receives, it drops that route -- the path would loop back through itself.
Two BGPs in one: inside the border and across it
BGP actually wears two hats. When a router in one AS speaks BGP to a router in a different AS, that is external BGP, or eBGP, and it is the real cross-border conversation where policy and economics are applied. But there is a subtler problem: once an AS has learned a route from the outside, every router inside that AS needs to know about it too, otherwise a packet might reach a border router that has no idea where to send it next. So the same protocol is run a second way, internal BGP or iBGP, to carry those externally-learned routes between the routers within a single AS. The BGP standard calls both flavours by one name, but the policy rules differ sharply between them.
The split matters because iBGP and the interior protocol from earlier do different jobs and coexist. The interior gateway protocol (like OSPF) figures out how to get a packet from one side of the AS to the other across the internal road network. iBGP, layered on top, distributes the knowledge of which external destinations exist and which border to exit from. So a packet's journey inside an AS is: iBGP tells the entry router 'the exit for this prefix is border router B', and the interior protocol works out the actual hop-by-hop path to reach border router B. Two protocols, two questions: iBGP answers 'which door do I leave by?' and the interior protocol answers 'how do I walk to that door?'
How a route gets chosen, and why BGP is fragile
An AS often hears several different BGP routes to the very same prefix, one from each neighbour, and must pick one. It runs them through a fixed ranking of attributes, and the order reveals the priorities. First and most powerful is local preference: a number the AS sets purely for its own policy reasons, typically to prefer a cheaper exit (send traffic out a free peering link before a paid provider). Only if local preference ties does it fall back to the shortest AS path length, which is the closest BGP comes to caring about distance, and it counts AS hops, not miles or milliseconds. Lower in the list sits the MED, or multi-exit discriminator, a hint a neighbour can send to nudge you toward one of its entry points over another.
Now put the whole picture together. The routers that run full BGP and carry a route to every destination on the Internet, holding no default route at all, live in what is called the default-free zone. A router in the default-free zone cannot shrug and say 'I do not know, send it upstream'; it must genuinely know a path to every prefix that exists. That is roughly a million prefixes today, a table that grows every year, and keeping it consistent across the planet is a continuous, delicate negotiation among parties who do not trust each other.
That negotiation is exactly why BGP is famously fragile, a theme the last guide in this rung explores fully. Three failure shapes recur. A flaky link can cause route flapping, where a prefix is announced and withdrawn over and over, and each change ripples outward forcing routers worldwide to recompute. A misconfiguration or attacker can cause a hijack, where an AS announces a prefix that is not its to announce and pulls the world's traffic toward it. And a leak happens when an AS accidentally re-advertises routes it was only supposed to use itself, accepting transit it never agreed to provide. The unifying lesson is sobering: classic BGP largely trusts what its neighbours tell it, so a single bad announcement can disrupt traffic far away. The glue holding the Internet together is held, in turn, mostly by good faith.