Every AS in this graph runs a tiny path-vector protocol like real BGP: it hears route announcements for prefix 198.51.100.0/24 from each neighbor, prepends itself to the AS-path, and keeps only the shortest AS-path it has heard (ties broken by neighbor ID). That best route is what it re-announces onward — exactly how the internet's routing table actually converges.
The attacker AS is only peered with one neighbor, but it can lie about how short its path is. "Launch Hijack" makes it originate the same prefix with a forged AS-path of the length you set. A shorter forged path out-competes the honest, longer path to the real origin at every AS that hears it — traffic silently reroutes to the attacker.
best(v) = argmin_{route r heard at v} length(r.asPath)
accept(r) only if origin(r) not already visited (loop check)
RPKI: reject r if origin(r) ≠ ROA[prefix]
- Forged AS-path length — shorter looks "closer" and wins more of the network; a forged length of 1 out-competes almost every real route.
- RPKI ROV — every AS checks the route's origin ASN against a signed Route Origin Authorization for the prefix. Since the attacker isn't the authorized origin, the very first AS that peers with it rejects the announcement before it can spread — the hijack never leaves the attacker's own doorstep.
- Toggle RPKI off and re-launch the same hijack to see how far a forged short path travels with no origin check at all.
Real-world relevance: this is the actual defense (RFC 6811 Route Origin Validation, backed by RPKI/ROAs) that networks deploy against real incidents like the 2008 Pakistan Telecom YouTube hijack or the 2022 KLAYswap BGP hijack — both cases where a shorter forged path redirected traffic with no cryptographic check to stop it.