Which signal is commonly used to detect a BGP route hijack in real time?

• A. Unexpected prefixes or origins
• B. Increased BGP session uptime
• C. Stable AS_PATH with no changes
• D. A decrease in the number of advertisements from the local origin

Answer: (A)

Detecting a BGP route hijack in real time relies on spotting anomalies in who is announcing prefixes. When a prefix appears with an origin AS that isn’t the legitimate owner, or when a prefix suddenly starts coming from an unexpected origin, that mismatch is a strong indicator that traffic could be being hijacked or misrouted. This direct signal—unexpected prefixes or origins—puts the spotlight on unauthorized or abnormal announcements, which is exactly what a hijack involves.

In contrast, increased BGP session uptime doesn’t signal hijacking, since a hijack can occur regardless of how long a session has been up. A stable AS_PATH with no changes suggests the routing information hasn’t been altered, which would argue against a hijack. And a decrease in advertisements from the local origin could be caused by legitimate filtering, outages, or policy changes, not a rogue announcement.

So the real-time cue you’d rely on is noticing prefixes appearing from origins that aren’t expected.