BGP Prefix Hijack & RPKI Route Origin Validation

Ten autonomous systems run a live path-vector routing protocol over a small three-tier internet topology. Each AS hears route announcements from its neighbors, prepends itself, and keeps only the shortest AS-path to a target prefix — the same rule real BGP uses to pick routes. Launching a hijack makes an attacker AS originate that same prefix with a forged, artificially short AS-path, and the simulation re-converges the whole network live, showing exactly which ASes get fooled into routing traffic to the attacker instead of the legitimate origin. Toggling RPKI Route Origin Validation on shows the actual defense: the attacker's only neighbor checks the announcement's origin ASN against a Route Origin Authorization and rejects it outright, so the forged route never propagates past the attacker's own doorstep.