Cloudflare's OTC-stamped BGP probes caught two Tier-1s stripping the leak guard

Route leaks push traffic down unintended paths and have knocked large parts of the internet offline, yet preventing them has meant hand-written, error-prone routing policies. RFC 9234 moves that intent into BGP: a Role capability makes neighbors agree on their relationship, and the Only to Customer (OTC) attribute marks a route that must only propagate downward, so a compliant router rejects a leak without operator policy.

Measuring adoption of RFC 9234 is hard because OTC can be stamped on egress by the sender or on ingress by a receiver, so a public path does not reveal who set it. Counting distinct OTC values in RouteViews and RIPE RIS found 361 candidates, but fillers inflate that; matching OTC to the path's first AS left nine, and heuristics raised the estimate to 36. Cloudflare's own network removes ambiguity: with thousands of direct peers, it checked BMP feeds for routes whose OTC equaled the peer's ASN, finding 67 ASes that set the attribute in three months.

To find strippers, Cloudflare announced an IPv4 and an IPv6 prefix with OTC set to its own ASN from all peering locations, then withdrew them to trigger path hunting. Any path ending at Cloudflare's ASN without OTC had been stripped by the preceding AS, identified by parsing UPDATEs from public collectors and its own routers. The first pass found six droppers, including two Tier-1s, GTT (AS3257) and Arelion (AS1299); a trusted-set iteration found nine more. The two Tier-1s appeared in 96.6% of IPv4 and 92.9% of IPv6 OTC-absent paths; 33.1% of IPv4 and 17% of IPv6 paths overall lost OTC.

The stripping matters because OTC is an optional transitive attribute: even routers without RFC 9234 support must pass it along, and stripping it disables leak prevention for compliant ASes several hops away. GTT and Arelion told Cloudflare they removed the attribute as a defensive practice after past BGP error-handling incidents, including one where malformed OTC reset sessions. Cloudflare shared findings with both: Arelion rolled out configurations that preserve OTC soon after, verifiable in public data, while GTT's configuration still strips it.

Announce OTC-stamped test prefixes; watch who strips them

Thousands of direct peers give Cloudflare a vantage point where OTC can be attributed to one AS, removing the ingress/egress ambiguity that poisons public RIB dumps.

Announcing test prefixes with OTC set to Cloudflare's own ASN and then withdrawing them produced a stream of paths where a missing OTC on the final hop could only mean the named neighbor stripped it.

Parsing UPDATE messages instead of RIB snapshots captured both announcement and withdrawal phases, surfacing far more routes for the attribution algorithm.

Because OTC is optional transitive, a handful of stripping Tier-1s silently broke leak prevention for compliant ASes behind them, which made engaging the two networks worth the effort.

Presenting each network with evidence converted measurement into change: Arelion began preserving OTC within days of the conversation.

When public data cannot tell who obeys a protocol, emit your own test signal from many vantage points and watch who drops it: direct observation converts ambiguity into names, and names into fixes.

Arelion began preserving the OTC attribute shortly after Cloudflare shared the findings, and the change is verifiable in public collector data through monocle queries on Cloudflare's test prefix. GTT's configuration still strips OTC, which Cloudflare says will keep hindering RFC 9234 route-leak prevention through AS3257 until it preserves the attribute or configures BGP Roles. Cloudflare has started gradually deploying Role configurations across its own routers and plans to publish the adoption data in Cloudflare Radar's Routing section.