On Tuesday 27 October 2026, in the morning plenary of RIPE 93 in Sofia, Shyam Krishna Khadka of the University of Twente said that 20,432 routers on the public internet will exchange a BGP OPEN message with anyone who asks. The number comes from a scan of the entire IPv4 address space that he ran with Suzan Bayhan, Ralph Holz and Cristian Hesselman in February 2026 and published at TMA 2026. The 141,313 addresses that answered belong to routers in 4,194 autonomous systems, and 1,127 of those routers are border routers peering with 1,496 other networks.
Nothing was compromised and the scan did not try. What the paper shows is that an eleven-year-old best current practice, RFC 7454, is ignored by a few thousand networks, and that the cost is a quiet leak of control-plane facts plus a free target for anyone who wants to burn a router's CPU. We also put our own ASN data next to the networks that top the list.
RFC 7454 asks for one thing, and the protocol's own check comes too late
Section 4 of RFC 7454 tells operators to discard packets to TCP port 179 that are "sourced from an address not known or permitted to become a BGP neighbor". One of its authors, Ivan Pepelnjak, tested in October and November 2023 what routers actually do when a stranger knocks. Arista EOS dropped the SYN, Cisco IOSv answered with a RST, and Cumulus closed the connection once its BGP daemon saw an unknown source. One "major router vendor" he chose not to name completed the handshake, swapped OPEN messages with the intruder, and only then sent a Cease. That last behavior is what the Twente team went looking for.
BGP does have a built-in defense: RFC 4271 says a speaker must reject an OPEN from a peer whose ASN it does not recognize. But that check runs after the TCP connection exists, after the router has parsed the stranger's message, and on the "ugly" vendor after it has sent its own OPEN. The validation is real. It just happens three steps late.
From 6.25 million SYN-ACKs to 141,313 OPENs
The scan ran from Enschede between 2 and 5 February 2026. ZMap first swept IPv4 for anything that answered a SYN on port 179, and 6.25 million addresses did. The team's own tool, Scan-179, then completed the handshake with each one and sent a valid OPEN: BGP version 4, the university's own ASN, a 90-second hold time, and five capabilities picked to look like an ordinary dual-stack router. The probe closed the connection the moment it got a reply.
Most of the 6.25 million was noise. 86% sent something that was not BGP at all, a RST, a FIN or silence, in some cases from a firewall in front of the real device rather than the router itself, and another 9% never finished the TCP handshake, almost all of them by running into the 30-second timeout. That left 277,408 addresses, about 5%, that spoke BGP. Half of them, 136,095, rejected the OPEN with a NOTIFICATION and hung up. The other 141,313 sent back an OPEN of their own. Fifteen went further and sent a KEEPALIVE, ready to bring up a session with a stranger.
Counting addresses overstates the problem. Shodan's report of 15 December 2025 lists 283,995 addresses with an open BGP port, but an address is an interface, not a router. Since RFC 6286 says the BGP Identifier should be unique within an AS, grouping responders by the ASN and identifier pair in their OPEN collapsed the 141,313 addresses to 20,432 routers. Another 1,627 addresses that echoed the probe's own ASN and identifier back were dropped as honeypots.
What one OPEN message gives away
An OPEN is small: a version byte, an ASN, a hold time, a 32-bit BGP Identifier and a list of capabilities. Each field says more than it looks. A private ASN marks an internal router: a confederation, a private core, or a customer numbered from private space. The identifier is a router ID that is very often a real loopback address. The capability list says which address families and features the box runs, and across the 20,432 routers the team saw only 36 distinct patterns, which the authors note is too few to tell one router from another on its own.
The paper files the consequences under three headings. Reconnaissance: transport-layer fingerprints already identify router vendors at internet scale, and an OPEN hands over the application layer on top. Bugs that fire before validation finishes: FRR's CVE-2022-40302 and CVE-2022-43681, presented at Black Hat 2023, were malformed OPEN messages that could crash the BGP daemon of an FRR router on version 8.4 or earlier once it parsed a stranger's message. And control-plane exhaustion: every half-opened session costs CPU, memory and state, and a router that completes handshakes with the whole internet is, in Pepelnjak's words, "a pretty good target for a TCP SYN flood".
Border, internal, and the 3,181 nobody can place
The team sorted routers using nothing but the OPEN and the interface addresses. A private or reserved ASN in the OPEN means an internal router. A public ASN plus at least one interface in a different public AS means a border router, because eBGP neighbors normally share a /30 or /31 drawn from one side's space. A public ASN whose interfaces all map to the same AS stays unclassified: iBGP-only box, or an edge router that numbers its peering links from its own blocks.
Three quarters of the border routers connect to a single other AS, and one, at a research network in the United States, connects to 21. Among internal routers 60% show a single exposed address and 90% fewer than ten, but the top decile aggregates up to 1,208 addresses on a single box. The three ASes with the most exposed internal addresses are an ISP in the Philippines with 1,208, a telecom in Grenada with 801, and an ISP in Vietnam with 735. The paper does not name them. The authors contacted twelve operators. One of them answered that BGP's default behavior was protection enough.
The per-AS view is the part operators should read twice. Of the 4,194 networks, 58.4% expose only internal routers, 14.7% only border routers, and 112, under 3%, both. The obvious reading is that plenty of networks applied RFC 7454 at the edge and forgot the core, where loopbacks and point-to-point links still carry public addresses that answer on 179. An internal router has no business accepting a TCP connection from outside its AS at all, so each of those 16,124 is also a sign that the control-plane filter of RFC 6192 is missing, not just the BGP ACL of RFC 7454.
Juniper 61 percent, Teldat second, and why that is not a vendor ranking
Vendors came from a second exposure. The team queried Shodan for SNMPv3 responses from the OPEN responders (an SNMPv3 engine ID carries the maker's enterprise number) and got a vendor for 8,871 routers, 43.4% of the total. Juniper accounts for 5,448 of them and Teldat, a router maker from Tres Cantos near Madrid, for 2,956. The authors warn against reading this as a security ranking, and they are right: a 2021 study using the same SNMPv3 method found Cisco the most common router vendor overall, so Juniper's lead says who leaves 179 open, not who sells the most boxes. In the top 20 ASes by identified routers, most of each network's routers come from a single vendor, only six networks use more than one, and none uses more than three. Exposure follows the AS, not the chassis.
The paper does not publish its list of 4,194 ASes, so we cannot profile all of them. We did look up the networks at the head of that top-20 chart in our own ASN data: Telefónica de España (AS3352), Integratel Perú (AS6147), MEO in Portugal (AS15525) and Uninet in Mexico (AS8151). All four are classified as ISPs, two registered with the RIPE NCC and two with LACNIC, and together they announce more than 13,600 IPv4 prefixes in our data. These are national incumbents, and whatever leaves their port 179 open is a standing configuration choice, not a forgotten lab router.
Five ways to shut the door, in the order to try them
RFC 7454's answer is the first and cheapest: an ACL on every interface, or in the control-plane policer, that permits TCP 179 only from configured neighbors and drops the rest before the TCP stack sees it. Second, for directly connected peers, GTSM (RFC 5082) expects a TTL of 255 and discards anything lower, which kills every packet that crossed a router to reach you. Third, TCP-AO (RFC 5925), or MD5 where that is all the far end supports, so an unauthenticated SYN fails before any state is allocated. Fourth, the operating system's connection handling, which refuses a socket to unknown sources with a RST before any BGP code runs, as Cisco IOSv did in Pepelnjak's test. Fifth is the RFC 4271 OPEN validation every router already performs, which fired too late for the 141,313.
To be fair to the operator who said the default is enough: the session really will not come up, and only 15 addresses got as far as a KEEPALIVE. But that is a weaker promise than it sounds. The router has still parsed untrusted input, spent a socket, and told the scanner its ASN, router ID and feature set. The authors' guess at why the gap persists is more mundane than negligence: vendor hardening guides are complex and hard to interpret, and some platforms lack the software support to lock down port 179.
If you run a network, check from outside it: an nmap -p 179 from a host beyond your AS against your loopback and link ranges will show the SYN-ACKs. The February scan covered IPv4 only, so a clean result there says nothing about your IPv6 side.
The ASN and originating prefix behind every address are part of every Ipregistry IP lookup, and an ASN lookup adds the registry, the announced prefixes and the network type that separates an incumbent ISP from a hosting provider, which is the data we used above to put names on the paper's AS numbers. You can try the API with 20,000 free lookups to get started.
Keep users in the loop Ship release notes that get read. Try Noticeable