Routing · XB Field Notes

An nginx prefix is a candidate until matching finishes

Mon, 17 Jan 2028 00:00:00 +0000

An nginx location selects configuration for a request within the chosen server. For the flat prefix and regex locations tested here, an exact match finishes the search; otherwise nginx remembers the longest matching prefix and can then choose the first matching regex. If no applicable regex wins, the remembered prefix supplies the configuration. This is a selection process, not simply the first block encountered in the file.

When it breaks

A prefix is a string prefix, not automatically a complete path segment. location /api also matches /apix. If the intended family is the endpoint /api plus descendants under /api/, express those boundaries deliberately. Depending on an unstated segment boundary can apply the wrong handler, cache policy, or access rule to paths that merely share the same initial letters.

The longest ordinary prefix is not always the final choice. A regex matching .php can take a request that also matched a more detailed API prefix. Moving that prefix above the regex does not change the basic priority rule. Configuration order matters for competing regexes, while ordinary prefixes are compared by matching length rather than declaration position.

The ^~ modifier suppresses regex searching when that prefix is the selected longest prefix at the relevant level. It is not a regex operator, and it is not an unconditional protection for every path that begins with a shorter marked prefix. Nested location structures and internal redirects require additional reasoning; the following fixture intentionally uses a flat server to make each selection unambiguous.

A prefix is still a candidate. Static illustration of the source and its limits. Reported fixture outcomes were not rerun for this graphic.

Check it quickly

The integration results below are historical observations; this revision did not rerun the fixture.

Run the script with host Python, Docker, and the pinned nginx image available. The recorded environment used nginx 1.28.0 on Linux arm64 with Docker 29.3.1. It builds a temporary configuration image, validates it with nginx -t, sends real HTTP requests through a port published only on host loopback, and removes its own containers, image tags, and network:

from contextlib import contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import http.client,json,socket,subprocess,time,uuid

NGINX='nginx@sha256:552e7481ca93ffccd046aa658dbbed22caefbc09c66fa7cd247cbb90b8a5c609'
PYTHON='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
def docker(*args,check=True):
 result=subprocess.run(['docker',*args],capture_output=True,text=True,timeout=120)
 if check:assert result.returncode==0,result.stderr
 return result
def wait(predicate):
 deadline=time.monotonic()+15
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except OSError:pass
 time.sleep(.1)
 raise AssertionError('fixture did not become ready')

@contextmanager
def lab(configuration,files=None,backend=None):
 name='xbcatm-nginx-'+uuid.uuid4().hex[:10];tags=[name+':proxy',name+':backend'];containers=[name+'-proxy',name+'-backend']
 try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'files').mkdir();(root/'nginx.conf').write_text(configuration)
 for path,content in (files or {}).items():
 target=root/'files'/path;target.parent.mkdir(parents=True,exist_ok=True);target.write_text(content)
 docker('network','create',name)
 if backend is not None:
 (root/'backend.py').write_text(backend)
 (root/'backend.Dockerfile').write_text(f'FROM {PYTHON}\nCOPY backend.py /backend.py\nCMD ["python", "/backend.py"]\n')
 docker('build','--network','none','-f',str(root/'backend.Dockerfile'),'-t',tags[1],str(root))
 docker('run','-d','--name',containers[1],'--network',name,'--network-alias','backend',tags[1])
 wait(lambda:docker('exec',containers[1],'python','-c','import socket;s=socket.create_connection(("127.0.0.1",8081),timeout=.5);s.close()',check=False).returncode==0)
 (root/'Dockerfile').write_text(f'FROM {NGINX}\nCOPY nginx.conf /etc/nginx/nginx.conf\nCOPY files /srv\n')
 docker('build','--network','none','-t',tags[0],str(root))
 docker('run','--rm','--network',name,tags[0],'nginx','-t')
 docker('run','-d','--name',containers[0],'--network',name,'-p','127.0.0.1::8080',tags[0])
 details=json.loads(docker('inspect',containers[0]).stdout)[0]
 binding=details['NetworkSettings']['Ports']['8080/tcp'][0];assert binding['HostIp']=='127.0.0.1';port=int(binding['HostPort'])
 def ready():
 connection=socket.create_connection(('127.0.0.1',port),timeout=.5);connection.close();return True
 wait(ready)
 def request(path,method='GET',headers=None,body=None):
 connection=http.client.HTTPConnection('127.0.0.1',port,timeout=5)
 try:
 connection.request(method,path,body=body,headers=headers or {})
 response=connection.getresponse();return response.status,{k.lower():v for k,v in response.getheaders()},response.read()
 finally:connection.close()
 yield containers[0],request
 finally:
 docker('rm','-f',*containers,check=False);docker('image','rm',*tags,check=False);docker('network','rm',name,check=False)

def config(locations,extra=''):
 return 'worker_processes 1;\nerror_log /tmp/error.log notice;\nevents {}\nhttp {\naccess_log off;\n'+extra+'\nserver { listen 8080; root /srv;\n'+locations+'\n}\n}\n'

locations=r'''
location / { return 200 "fallback"; }
location /api/ { return 200 "api-slash"; }
location /api/admin/ { return 200 "admin"; }
location = /api { return 200 "exact"; }
location /api { return 200 "api-string"; }
location ^~ /static/ { return 200 "static"; }
location ~ \.php$ { return 200 "php-regex"; }
'''
with lab(config(locations)) as (container,request):
 cases={'/api':'exact','/api?x=1':'exact','/apix':'api-string','/api/users':'api-slash','/api/admin/log':'admin','/api/admin/test.php':'php-regex','/static/test.php':'static','/unmatched':'fallback'}
 for path,expected in cases.items():
 status,headers,body=request(path);assert status==200 and body.decode()==expected,(path,status,body)
 print('exact matching ignores the query; ordinary prefixes use longest string match, including /api matching /apix')
 print('a regex overrides the ordinary longest prefix, while the selected ^~ prefix skips that regex')

Both /api and /api?x=1 return exact. The query string does not participate in location matching, so adding an argument does not make the exact path stop matching. The selected block explicitly returns that marker. Exact matching selects configuration; it does not inherently mean a filesystem root is read or a particular application is invoked.

The request /apix returns api-string, demonstrating that the plain /api prefix reaches beyond a complete API segment. /api/users instead returns api-slash, because /api/ is the longer matching prefix. /api/admin/log returns admin, showing the next level of ordinary longest-prefix selection without relying on the order those blocks appear.

Requesting /api/admin/test.php returns php-regex. The long /api/admin/ prefix was a candidate, but the regex phase selected another block. This is the important failure shape for a route whose author assumed a longer prefix automatically defeated a general script handler. A successful status alone would conceal the mistake, so each handler returns a distinguishable body.

Requesting /static/test.php returns static, because the selected /static/ prefix has ^~. The same suffix regex therefore does not take that request. An unmatched path returns the broad fallback marker. Together, these cases demonstrate the actual selection boundaries rather than merely proving that nginx accepts the configuration syntax.

The client sends the paths explicitly and checks response bodies as well as statuses. The fixture contains no real authentication policy or script execution, so its markers validate routing decisions only. When applying the pattern to a protected endpoint, test the actual handler and access behavior that will run after selection.

Review the selected handler and its later transitions

Start with the intended URL families, then list exact endpoints, descendant prefixes, and any overlapping regexes. Include near-miss paths such as /apix, case variants where relevant, and encoded or normalized forms. nginx matches a normalized URI, so a security review based only on the raw request text can miss which configuration ultimately applies.

Inspect the effective configuration, including included files and the selected virtual server. A correct location in a server block that the request never enters cannot fix routing in another block. Use controlled response markers or logs during verification rather than inferring selection from a familiar page returned by several handlers.

Finally, account for rewrites, index handling, and other internal redirects that can trigger a new location search. The first selected block may not be the final handler. Test the full request path and preserve enough evidence to explain both the initial match and the response actually produced.

Sources

nginx core location directive, normalized URI matching, exact matches, prefixes, and regex selection, checked 2026-10-15.
How nginx processes a request, server selection and location-based request handling, checked 2026-10-15.

Anycast lets routing select a replica

Mon, 01 Nov 2027 00:00:00 +0000

Anycast gives an address several homes. Multiple sites announce the same prefix, and each network selects a usable path according to routing policy. This article focuses on Internet BGP; local anycast can use an interior routing protocol. A client usually lands at a topologically close replica without first contacting a global load balancer. When one site withdraws its announcement, the control plane can converge on another home.

One address, many announcements

An anycast service assigns the same unicast address or prefix to independent instances. Each edge router advertises reachability with BGP. Neighbors compare paths and install a best route in their local routing information base; packets then follow ordinary forwarding toward that selected next hop. The application sees one destination even though several sites can answer it.

“Nearest” means nearest according to routing policy and topology, not a guaranteed geographic distance. A higher local preference can beat a physically shorter path. If local preference ties, a shorter AS path is generally preferred, followed by more vendor- and policy-specific tie breakers. Operators can steer traffic by changing these attributes, prepending an AS path, or withdrawing a prefix. The important contract is reachability, not a promise that every client chooses the same site.

Routing performs the failover

If a site loses its service or upstream, its route should be withdrawn, often by a health-controlled session. Upstream routers propagate the withdrawal and select a surviving announcement. The forwarding path does not need a DNS answer to change, so a whole edge location can disappear while the address remains valid. BGP convergence is not instantaneous: packets can be lost during the transition, and different networks may converge at different times. Clients still need retries and sensible connection timeouts.

Anycast is especially useful for stateless or easily re-established protocols such as DNS, UDP-based discovery, and CDN edges. It also spreads an attack surface across sites, although capacity and filtering must be coordinated. A route that remains advertised while the process is dead is worse than no route: traffic is sent to a black hole. Tie route announcements to a real readiness signal and monitor both control-plane reachability and application responses.

Stateful sessions mind the move

An established TCP connection can reach a different site after a route change. Without the old socket state, that instance may reset or drop it. A shared backend preserves application state, not the TCP connection; clients still need reconnect-and-rebuild behavior. Idempotency keys can prevent repeated side effects after a reconnect. Do not infer stickiness from one successful trace: topology changes can select another replica even during a flow.

Observability must include the serving site, route age, and withdrawal reason. A single global success rate can hide one region black-holing traffic while other regions look healthy. Sample from several networks, record the anycast address separately from the site identity, and alert when a site is still advertised but its service checks fail.

When it breaks

A route leak or an accidental high local preference can attract traffic far from the intended site. A partial withdrawal can leave some peers on a stale path, producing asymmetric loss rather than a clean failover. MTU, firewall, and ACL differences between replicas create failures that look like random routing. If the service has local state, users may see resets only after the control plane has already converged.

Avoid advertising a prefix from a site until the process, dependencies, and return path are ready. Test withdrawal from a staging address, measure convergence from more than one vantage point, and keep a non-anycast management path for recovery. Routing is the selection mechanism; it is not an application health check unless the announcement is explicitly coupled to one.

Schematic route choices, not a map or latency measurement. The local Go model selects among given candidates and omits real topology and convergence timing. No model or Internet routing experiment was rerun.

Check it quickly

This local Go model captures only local preference and AS-path length for one prefix. It tests path tie-breaking, input-order independence, policy override, withdrawal, an empty candidate set, and backup recovery. No packets or BGP session leave the process.

package main

import "fmt"

type route struct {
 name string
 localPref int
 asPath int
 advertised bool
}

// This fixture models only local preference and AS-path length for one prefix.
func best(routes []route) (route, bool) {
 var chosen route
 for _, candidate := range routes {
 if !candidate.advertised {
 continue
 }
 if chosen.name == "" || candidate.localPref > chosen.localPref ||
 (candidate.localPref == chosen.localPref && candidate.asPath < chosen.asPath) {
 chosen = candidate
 }
 }
 return chosen, chosen.name != ""
}

func want(ok bool, message string) {
 if !ok {
 panic(message)
 }
}

func main() {
 routes := []route{
 {name: "tokyo", localPref: 100, asPath: 2, advertised: true},
 {name: "singapore", localPref: 100, asPath: 3, advertised: true},
 }
 chosen, ok := best(routes)
 want(ok && chosen.name == "tokyo", "shorter AS path should win the tie")
 chosen, ok = best([]route{routes[1], routes[0]})
 want(ok && chosen.name == "tokyo", "input order must not beat path length")
 routes[1].localPref = 200
 chosen, ok = best(routes)
 want(ok && chosen.name == "singapore", "local policy should override path length")
 routes[1].advertised = false
 chosen, ok = best(routes)
 want(ok && chosen.name == "tokyo", "withdrawal should select the surviving site")
 routes[0].advertised = false
 _, ok = best(routes)
 want(!ok, "with every announcement withdrawn there is no route")
 _, ok = best(nil)
 want(!ok, "an empty candidate set must not invent a route")
 fallback := route{name: "sydney", localPref: 50, asPath: 4, advertised: true}
 chosen, ok = best(append(routes, fallback))
 want(ok && chosen.name == "sydney", "a backup announcement should recover reachability")
 fmt.Println("PASS: path length, policy priority, withdrawal, empty set, and backup")
}

Save this as anycast_model.go and run go run anycast_model.go. The expected output is PASS: path length, policy priority, withdrawal, empty set, and backup. Check formatting with gofmt -d, static diagnostics with go vet, and execution with go run -race. Equal values in both modeled fields retain the first candidate. The model omits later tie breakers, MED, eBGP/iBGP rules, communities, topology, and convergence timing. It proves selection among given candidates, not convergence on the Internet.

Sources

RFC 4271: A Border Gateway Protocol 4, route selection and path attributes, checked 2026-09-09.
RFC 4786: Operation of Anycast Services, deployment, routing, and failure considerations, checked 2026-09-09.

BGP aggregation shrinks the routing table

Fri, 08 Oct 2027 00:00:00 +0000

Aggregation can replace several more-specific advertisements with one covering prefix. It reduces downstream table entries only where the specifics are actually suppressed and no alternative peer supplies them. The components need not fill the whole summary: advertising a sparse block also attracts traffic for its holes. Aggregation therefore combines a scaling decision with a reachability and ownership decision.

What aggregation actually buys

A peer receiving three component prefixes plus their summary has four routes, not one. In FRR, aggregate-address 10.1.0.0/16 summary-only suppresses advertisements of the covered more-specifics. It does not delete those routes from the aggregator’s own BGP table. FRR requires at least one contributing more-specific in that BGP table; having only an unrelated routing-table entry is insufficient.

A stable summary can hide changes to individual contributors from downstream peers. That benefit is conditional: losing the last contributor, changing aggregate attributes, or changing export policy can still generate updates. Suppression does not repair the failed customer path. It changes what other networks learn about the failure, while the aggregator must continue diagnosing its internal components.

The covering route is also broader than the sum of a few listed subnets. Before announcing it, verify authority for the whole range and the intended aggregate origin. Address alignment and a short table are insufficient evidence of permission. A provider may legitimately aggregate customer space under its allocation; different component origins do not automatically make aggregation unauthorized.

Preserve a clear origin

FRR’s suppress-map selects which more-specifics to suppress. Its as-set option concerns a different dimension: representing AS information from component paths. An AS_SET is an unordered set, not a list of only the customers’ origin numbers. Under the historical RFC 4271 path-length calculation, a set counts as one, regardless of its members.

RFC 9774 now deprecates AS_SET and AS_CONFED_SET. Unless explicitly configured otherwise during transition, speakers must not advertise them and must treat received routes containing them as withdrawn. Choose an unambiguous authorized aggregate origin and appropriate ROAs instead of treating AS_SET as a routine aggregation fix. An origin filter does not automatically accept an aggregate merely because a router generated it.

When it breaks

For ordinary destination-based lookup in a selected forwarding table, the longest installed matching prefix wins. A valid /24 therefore beats its covering /16, regardless of their relative BGP local preferences. First, however, each route must pass policy, next-hop resolution, and installation. BGP selection among paths for one prefix and forwarding lookup across different prefixes are separate decisions.

If one component disappears, only destinations that lose their usable route fall back to the summary; healthy components can keep forwarding. One customer’s withdrawal does not inherently blackhole every address covered by the aggregate. At the aggregating router, a discard route for unmatched summary destinations prevents traffic from following a default route back upstream and forming a loop.

Discard behavior and diagnostic messages depend on the platform and configuration. Neither silence nor ICMP delivery is universal. Removing the summary also does not necessarily mean no route: another covering prefix or a default can remain. Check the actual forwarding table and counters rather than declaring the summary dishonest solely because a specific prefix is absent.

Containment is schematic, not proportional address space. The lookup model preserves the healthy component and sends unmatched summary destinations to discard. It does not validate BGP sessions, origin policy or convergence, and was not rerun.

Check it quickly

Run this self-contained Python 3 model with assertions enabled. It creates no sockets and changes no router configuration. Two customer routes share a covering discard entry. The deliberately small model isolates longest-prefix matching and the scope of a component withdrawal; it does not implement BGP sessions, policy, or convergence.

from ipaddress import ip_address, ip_network

routes = {
 ip_network("10.1.0.0/16"): "discard",
 ip_network("10.1.4.0/24"): "customer-a",
 ip_network("10.1.7.0/24"): "customer-b",
}
def lookup(address):
 matches = [prefix for prefix in routes if ip_address(address) in prefix]
 if not matches:
 return "no-route"
 return routes[max(matches, key=lambda prefix: prefix.prefixlen)]

assert lookup("10.1.4.9") == "customer-a"
assert lookup("10.1.7.9") == "customer-b"
del routes[ip_network("10.1.4.0/24")]
assert lookup("10.1.4.9") == "discard"
assert lookup("10.1.7.9") == "customer-b"
print("withdraw A: A=discard, B=customer-b")
del routes[ip_network("10.1.0.0/16")]
assert lookup("10.1.4.9") == "no-route"
assert lookup("10.1.7.9") == "customer-b"
print("withdraw summary: A=no-route, B=customer-b")

The first output shows customer A falling into the discard route while customer B remains reachable through its own entry. After deleting the summary, A reports no route because this fixture intentionally has no default. B still resolves independently. Add a default entry as a follow-on exercise and observe how the no-route result changes.

On an authorized lab router, separately inspect received, selected, advertised, and installed routes before and after withdrawing a contributor. Confirm whether the summary survives and whether its attributes change. Router integration and forwarding behavior require that real exercise; the Python assertions establish only the stated lookup model.

Sources

RFC 4271 BGP-4, defines ATOMIC_AGGREGATE, AGGREGATOR and AS_SET, checked 2026-09-16.
FRR BGP route aggregation, documents aggregate generation, component suppression and AS-set options, checked 2026-09-16.
RFC 4632 CIDR, the classless prefix and longest-match forwarding model, checked 2026-09-16.
RFC 9774: Deprecation of AS_SET, updated aggregation and origin requirements, checked 2026-10-15.

A default route matches broadly; it does not rescue every failed path

Tue, 14 Sep 2027 00:00:00 +0000

An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.

When it breaks

A machine without a default can still reach destinations covered by connected or explicit routes. Conversely, adding a default does not prove internet access. The next hop needs to be reachable, forwarding and filtering must permit the traffic, and replies need a return path. A displayed gateway is only one part of that contract; application communication supplies the evidence that the configured path works.

A more specific rejection route wins over a working default. Linux route types such as unreachable intentionally stop forwarding for matching destinations. A failed neighbor lookup through a selected gateway also does not mean the kernel will automatically search for a healthier, less specific path. Static route preference and metrics are not a service-health monitoring or failover system.

Return-path errors are particularly misleading. The client can select the expected gateway and send traffic toward a listening server, yet fail because the server cannot route replies to the client. Repeatedly changing the client’s default may damage working destinations without repairing that missing reverse path. Inspect both directions and the actual source address before attributing every connection timeout to the sender’s gateway.

A route out still needs a route back. Intended source model only. Missing lab prerequisites keep executable acceptance blocked; no retained run is claimed.

Check it quickly

Source review, 2026-10-18: expected results and historical reports below were not rerun; current execution verification remains blocked.

These commands require a documented Linux lab policy permitting nested namespaces and proc mounts. NET_ADMIN and SYS_ADMIN do not override Docker’s built-in AppArmor mount denial. Setup permission failures are not routing results.

Save this as check-default-route.py and run python3 check-default-route.py with Docker. Python 3.11.16 and iproute2 6.1.0 build a client–router–target topology inside one disposable Linux container. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. All interfaces are newly created veth devices, and no port or route is published on the host:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def routed(setting):
 wire('client','c0','router','r0',['10.201.1.2/30'],['10.201.1.1/30'])
 wire('router','r1','target','t0',['10.201.2.1/30'],['10.201.2.2/30'])
 setting('router','net.ipv4.ip_forward',1)
 ip('client','route','add','default','via','10.201.1.1')
 ip('target','route','add','default','via','10.201.2.1')
with lab(['client','router','target']) as (root,stack,setting):
 routed(setting);ip('client','route','delete','default')
 ip('target','addr','add','198.51.100.9/32','dev','lo');ip('router','route','add','198.51.100.9/32','via','10.201.2.2')
 daemon=server(stack,'target','198.51.100.9')
 connected=ns('client','ping','-n','-c','1','-W','1','10.201.1.1');assert connected.returncode==0
 missing=request('client','198.51.100.9');assert not missing['ok'] and missing['errno']==101
 ip('client','route','add','default','via','10.201.1.1')
 chosen=json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0];assert chosen['gateway']=='10.201.1.1'
 healthy=request('client','198.51.100.9');assert healthy['ok']
 ip('client','route','add','unreachable','198.51.100.9/32')
 specific=request('client','198.51.100.9');assert not specific['ok'] and specific['errno']==113
 ip('client','route','delete','unreachable','198.51.100.9/32')
 recovered=request('client','198.51.100.9');assert recovered['ok']
 ip('target','route','delete','default')
 bad_return=request('client','198.51.100.9');assert not bad_return['ok'] and bad_return['type']=='TimeoutError'
 assert json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0]['gateway']=='10.201.1.1'
 ip('target','route','add','default','via','10.201.2.1')
 final=request('client','198.51.100.9');assert final['ok']
 print(json.dumps({'connected_ping_without_default':0,'no_default':missing,'chosen_route':chosen,'with_default':healthy,
 'specific_unreachable_route':specific,'specific_removed':recovered,'missing_return_route':bad_return,'return_route_restored':final}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client uses 10.201.1.2, with router neighbor 10.201.1.1. The target sits behind the router on another link and owns service address 198.51.100.9 on loopback. The router has a specific route to that service, and the target initially has a return default. The documentation address is used only within this isolated topology; no public server is contacted.

With the client’s default removed, pinging its directly connected router succeeds. An HTTP connection to the remote service fails with Linux ENETUNREACH, errno 101. Adding a default through 10.201.1.1 changes the route lookup to that gateway, and an actual HTTP request returns status 200. This demonstrates both the narrower connectivity that already existed and the additional path enabled by the default.

An unreachable /32 route is then installed for 198.51.100.9. The same connection now fails with EHOSTUNREACH, errno 113, despite the default still being present. Removing that specific route restores HTTP success. The kernel honored the more specific rejection; it did not treat the error as an invitation to fall back to the default gateway.

Next, the script removes only the target’s default route. The client’s lookup still names 10.201.1.1, but a new HTTP attempt reaches its timeout. Restoring the target’s default restores communication. This controlled comparison isolates the return-path dependency while leaving the client’s choice unchanged, providing stronger evidence than a one-sided route listing or an unexplained failed ping.

Inspect the exact flow before editing defaults

Record source address, destination, relevant policy rules, chosen interface, and gateway. A machine with several interfaces or routing tables can make different decisions for different sources, marks, or routing domains. Run diagnostic lookups with the application’s relevant inputs. The fixture uses ordinary destination-based routing and does not claim to reproduce every policy-routing or multipath configuration.

Check the next hop’s link reachability, the router’s forwarding decision, and the target’s route back to the actual source. NAT or a proxy may change which source the target sees. Error classes can guide this work: immediate local network-unreachable errors differ from an explicitly unreachable host route and from a deadline expiring while a reply cannot return. Keep those distinctions in incident evidence.

Defaults are useful because they summarize destinations whose individual routes the host need not know. Configure them deliberately, verify exceptions, and test representative round trips after changes. If automatic failover is required, use a mechanism that observes the relevant path and updates routing appropriately. A second configured gateway or a preferred metric alone does not establish that behavior.

Sources

Linux ip-route(8), default routes, route lookup and unreachable route types, checked 2026-09-12.
RFC 4632 CIDR, longest-prefix matching and route specificity, checked 2026-09-12.
RFC 1812 IPv4 router requirements, IPv4 forwarding and destination reachability, checked 2026-09-12.
Docker AppArmor policy, and built-in profile, mount-policy prerequisite, checked 2026-10-18.

BGP is the Internet routing table

Sun, 12 Sep 2027 00:00:00 +0000

BGP exchanges reachability between independently operated networks, but there is no single authoritative Internet forwarding table. Each router learns a policy-filtered view, chooses routes, and attempts to install usable next hops. Two routers can legitimately select different paths to the same prefix. Understanding BGP means separating announcements, selection policy, and packet forwarding rather than treating them as one universal answer.

The AS path carries history and policy

In ordinary eBGP operation, a speaker prepends its AS number when advertising a route externally. A receiver normally excludes paths containing its own AS to avoid inter-AS loops. There are configured exceptions and protocol extensions. Inside an AS, iBGP does not normally add another AS number; its advertisement restrictions and route-reflector rules address a different loop problem.

AS_PATH is also a policy input and a selection attribute. Repeated prepending can make one route less attractive where path length matters, but cannot override another network’s higher-priority local policy. There is no general rule that prepending makes a route fail filtering. Filters must be understood in their actual operator and customer context.

LOCAL_PREF is an attribute distributed to internal BGP peers, normally not to external peers. Weight, where an implementation provides it, is router-local and is not a standard BGP path attribute. Conflating these two controls hides an important distinction: a local preference change can influence decisions across the AS, while a weight change generally affects one router.

Compare the same prefix first

A router’s best-path process compares candidate paths for the same prefix. The exact sequence depends on the implementation and configuration, including eligibility, local policy, AS-path length, MED comparison rules, and next-hop reachability. A vendor’s weight-first list is not the complete protocol definition. MED is commonly compared within the same neighboring AS, with configurable exceptions.

Forwarding then performs longest-prefix matching over the installed destination routes. A /25 and its covering /24 do not compete through the same best-path tie-break list. If both are accepted and installed, the /25 matches its half of the address range even if the /24 has a shorter AS path. Policy routing and other forwarding features require additional inspection.

Table size likewise depends on the observation point, address family, and date. Distinct prefixes, all received paths, and hardware FIB entries are different counts. Aggregation can reduce some advertisements, but multihoming and traffic engineering may require specific routes. An address-only aggregation estimate is not proof that every corresponding policy can be preserved.

When it breaks

An unauthorized origin announcement is a prefix hijack; a route leak exports learned reachability beyond its intended policy scope. They can overlap, but are not synonyms. The hypothetical /25 below illustrates lookup only: real networks may reject it through prefix-length, origin, or customer filters. An unfamiliar more-specific deserves investigation, not an immediate conclusion that an attack is live.

RPKI origin validation checks the announced prefix, authorized origin, and permitted maximum length against validated records. It does not authenticate the entire AS path or determine every export relationship. Valid-origin routes can still be leaked. Combine origin validation with appropriately scoped import and export policy, and monitor changes rather than assuming all updates propagate unchecked.

A healthy session also does not prove successful forwarding installation. Hardware exhaustion, unresolved next hops, or programming failures can leave a control-plane route unusable. Failure behavior varies by platform; software fallback is not guaranteed. Capacity planning must use the device’s actual table partitions, supported features, and installation telemetry, not a universal million-entry threshold.

Two distinct decisions: same-prefix path selection and cross-prefix forwarding lookup. The source fixture holds other conditions equal; it is not a router implementation or geographical shortest-path proof. No fixture was rerun.

Check it quickly

Run this Python 3 fixture with assertions enabled. The first half intentionally models only local preference and AS-path length, with every other selection condition held equal. The second half is an independent forwarding table. It uses documentation addresses and creates no sessions, listeners, or network announcements.

from ipaddress import ip_address, ip_network

paths = [
 {"name": "policy-first", "localpref": 200, "path": [64501, 64502, 64503]},
 {"name": "shorter", "localpref": 100, "path": [64504, 64503]},
]
def choose(candidates):
 return min(candidates, key=lambda p: (-p["localpref"], len(p["path"])))
assert choose(paths)["name"] == "policy-first"
paths[1]["localpref"] = 200
assert choose(paths)["name"] == "shorter"

routes = {ip_network("198.51.100.0/24"): "legitimate",
 ip_network("198.51.100.128/25"): "unexpected"}
def forward(address):
 matches = [p for p in routes if ip_address(address) in p]
 return routes[max(matches, key=lambda p: p.prefixlen)]
assert forward("198.51.100.20") == "legitimate"
assert forward("198.51.100.200") == "unexpected"
print("same prefix: local preference first, then path length")
print("different prefixes: lower half legitimate, upper half unexpected")

The longer path wins until local preference is equalized; then the shorter path wins. Separately, the lower address selects the legitimate /24, and the upper address selects the unexpected /25. These results explain two different decisions without claiming to implement a router. Real diagnosis must correlate received and advertised paths, selected routes, hardware installation, and permitted-client probes.

Sources

RFC 4271 BGP-4, the decision process and AS path loop detection, checked 2026-09-16.
RFC 6811 prefix origin validation, what RPKI validation does and does not prove, checked 2026-09-16.
RFC 7908 route leaks, the problem statement for leaked announcements, checked 2026-09-16.
CIDR Report, current IPv4 table size and per-AS more-specific counts, checked 2026-09-16.
FRR BGP path selection, implementation-specific selection controls and diagnostics, checked 2026-10-15.

proxy_pass maps the URI as well as selecting an upstream

Fri, 02 Apr 2027 00:00:00 +0000

nginx proxy_pass chooses an upstream destination and also affects the request URI sent there. The important distinction is whether the directive includes a URI component, not simply whether its text ends with a slash. In an ordinary prefix location, a literal target URI replaces the matching normalized prefix. An authority-only target can pass the original request URI when the request has not been rewritten.

When it breaks

An application serving /users may return 404 when the proxy forwards /api/users, even though the network connection succeeds. The opposite mismatch occurs when an application expects the public prefix and the proxy removes it. Comparing only client status and upstream reachability misses this class of error; inspect the exact method, path, query, and host the backend receives.

Slash boundaries are part of literal replacement. A target ending in /v1 still contains a URI, so replacing /join/ in /join/item yields /v1item. It does not preserve the original path merely because the target lacks a trailing slash. Thinking in terms of the replaced prefix and remaining suffix explains this result more accurately than a universal trailing-slash slogan.

Variables introduce another documented branch. When a variable-supplied proxy URL contains a URI, that URI is used as specified instead of applying the ordinary literal-prefix replacement rule. Regex and named locations also lack the same unambiguous prefix boundary. Configuration that works in a plain prefix location cannot be copied into those contexts without checking the corresponding contract.

Replace the prefix, keep the suffix. Static illustration of the source and its limits. Reported fixture outcomes were not rerun for this graphic.

Check it quickly

The integration results below are historical observations; this revision did not rerun the fixture.

Run the script with host Python, Docker, and the pinned nginx and Python images available. The recorded environment used nginx 1.28.0 and Python 3.11.16 on Linux arm64 with Docker 29.3.1. It starts an actual HTTP backend that echoes received request fields, validates nginx configuration, publishes only the proxy on host loopback, and removes its own images, containers, and network:

from contextlib import contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import http.client,json,socket,subprocess,time,uuid

NGINX='nginx@sha256:552e7481ca93ffccd046aa658dbbed22caefbc09c66fa7cd247cbb90b8a5c609'
PYTHON='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
def docker(*args,check=True):
 result=subprocess.run(['docker',*args],capture_output=True,text=True,timeout=120)
 if check:assert result.returncode==0,result.stderr
 return result
def wait(predicate):
 deadline=time.monotonic()+15
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except OSError:pass
 time.sleep(.1)
 raise AssertionError('fixture did not become ready')

@contextmanager
def lab(configuration,files=None,backend=None):
 name='xbcatm-nginx-'+uuid.uuid4().hex[:10];tags=[name+':proxy',name+':backend'];containers=[name+'-proxy',name+'-backend']
 try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'files').mkdir();(root/'nginx.conf').write_text(configuration)
 for path,content in (files or {}).items():
 target=root/'files'/path;target.parent.mkdir(parents=True,exist_ok=True);target.write_text(content)
 docker('network','create',name)
 if backend is not None:
 (root/'backend.py').write_text(backend)
 (root/'backend.Dockerfile').write_text(f'FROM {PYTHON}\nCOPY backend.py /backend.py\nCMD ["python", "/backend.py"]\n')
 docker('build','--network','none','-f',str(root/'backend.Dockerfile'),'-t',tags[1],str(root))
 docker('run','-d','--name',containers[1],'--network',name,'--network-alias','backend',tags[1])
 wait(lambda:docker('exec',containers[1],'python','-c','import socket;s=socket.create_connection(("127.0.0.1",8081),timeout=.5);s.close()',check=False).returncode==0)
 (root/'Dockerfile').write_text(f'FROM {NGINX}\nCOPY nginx.conf /etc/nginx/nginx.conf\nCOPY files /srv\n')
 docker('build','--network','none','-t',tags[0],str(root))
 docker('run','--rm','--network',name,tags[0],'nginx','-t')
 docker('run','-d','--name',containers[0],'--network',name,'-p','127.0.0.1::8080',tags[0])
 details=json.loads(docker('inspect',containers[0]).stdout)[0]
 binding=details['NetworkSettings']['Ports']['8080/tcp'][0];assert binding['HostIp']=='127.0.0.1';port=int(binding['HostPort'])
 def ready():
 connection=socket.create_connection(('127.0.0.1',port),timeout=.5);connection.close();return True
 wait(ready)
 def request(path,method='GET',headers=None,body=None):
 connection=http.client.HTTPConnection('127.0.0.1',port,timeout=5)
 try:
 connection.request(method,path,body=body,headers=headers or {})
 response=connection.getresponse();return response.status,{k.lower():v for k,v in response.getheaders()},response.read()
 finally:connection.close()
 yield containers[0],request
 finally:
 docker('rm','-f',*containers,check=False);docker('image','rm',*tags,check=False);docker('network','rm',name,check=False)

def config(locations,extra=''):
 return 'worker_processes 1;\nerror_log /tmp/error.log notice;\nevents {}\nhttp {\naccess_log off;\n'+extra+'\nserver { listen 8080; root /srv;\n'+locations+'\n}\n}\n'

backend=r'''from http.server import BaseHTTPRequestHandler,HTTPServer
import json
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=self.rfile.read(int(self.headers.get('Content-Length','0')))
 document={'path':self.path,'method':self.command,'body':body.decode(),'headers':{key:self.headers.get(key) for key in ['Host','X-Forwarded-For','X-Real-IP','X-Forwarded-Proto','X-Forwarded-Host']}}
 data=json.dumps(document).encode()
 self.send_response(200);self.send_header('Content-Type','application/json');self.send_header('Content-Length',str(len(data)));self.send_header('X-Backend-Info','fixture-node');self.end_headers();self.wfile.write(data)
 do_POST=do_GET
 def log_message(self,*args):pass
HTTPServer(('0.0.0.0',8081),Handler).serve_forever()
'''

locations=r'''
location /keep/ { proxy_pass http://backend:8081; }
location /strip/ { proxy_pass http://backend:8081/; }
location /replace/ { proxy_pass http://backend:8081/v1/; }
location /join/ { proxy_pass http://backend:8081/v1; }
location /variable/ { set $destination "http://fixture_pool/fixed?chosen=1"; proxy_pass $destination; }
'''
invalid=config(r'location ~ ^/bad/ { proxy_pass http://backend:8081/replacement/; }')
with lab(config(locations,'upstream fixture_pool { server backend:8081; }'),{'invalid.conf':invalid},backend) as (container,request):
 cases={'/keep/item?x=1':'/keep/item?x=1','/strip/item?x=1':'/item?x=1','/replace/item?x=1':'/v1/item?x=1','/join/item?x=1':'/v1item?x=1','/keep/a%2Fb?x=1':'/keep/a%2Fb?x=1','/strip/a%2Fb?x=1':'/a/b?x=1','/variable/item?original=1':'/fixed?chosen=1'}
 for path,expected in cases.items():
 status,headers,body=request(path);assert status==200 and json.loads(body)['path']==expected,(path,status,body)
 invalid_result=docker('exec',container,'nginx','-t','-c','/srv/invalid.conf',check=False)
 assert invalid_result.returncode!=0 and 'cannot have URI part in location given by regular expression' in invalid_result.stderr
 print('no URI preserves the original path; a literal URI replaces the normalized matching prefix, including its slash boundaries')
 print('a variable-supplied URI is used as specified; regex-location URI replacement is rejected by nginx -t')

An authority-only target in /keep/ forwards /keep/item?x=1 unchanged. A target ending in / inside /strip/ instead forwards /item?x=1. The query survives both of these literal examples. The backend’s JSON response supplies the evidence, rather than an assumption based on what the public URL looked like before nginx handled it.

The /replace/ location maps its prefix to /v1/, so /replace/item?x=1 becomes /v1/item?x=1. The deliberately missing separator in the /join/ target produces /v1item?x=1. Both requests reach the backend successfully. Their distinct paths demonstrate why a successful TCP connection or HTTP response does not establish the intended route mapping.

Encoded separators expose the normalization boundary. /keep/a%2Fb?x=1 remains encoded in the authority-only case, while /strip/a%2Fb?x=1 reaches the backend as /a/b?x=1 after normalized prefix replacement. This can change how an application divides path segments. Align the proxy and application’s path interpretation when encoded identifiers or access-control boundaries depend on those separators.

The variable example names a predefined upstream group and supplies /fixed?chosen=1 as its target URI. Requesting /variable/item?original=1 reaches exactly that fixed URI; the original suffix and query are not automatically appended. Using a known upstream group also keeps this example separate from arbitrary per-request hostname resolution and its resolver requirements.

A second configuration deliberately puts a proxy target with a URI part inside a regex location. nginx -t rejects it with the documented URI-part restriction. The active configuration is not replaced by this invalid file. This verifies a real configuration failure in addition to the successful routing cases.

Treat each public-to-backend mapping as a contract

For every proxy location, write down the public prefix, replacement URI if any, and expected backend path and query. Include boundary slashes and encoded forms in tests. If a rewrite changes the URI before proxying, revisit authority-only behavior too: forwarding the original request is conditional on processing the original URI, not an unconditional promise for every rewritten request.

Keep destination selection constrained to intended backends. A variable derived from untrusted request data should not become unrestricted authority to contact arbitrary hosts. Named upstream groups, explicit mappings, and appropriate rejection behavior should follow the application’s actual routing requirements rather than silently accepting an unknown destination.

Configure forwarded headers, connection reuse, timeouts, and upstream TLS according to their own contracts. A resolver directive is not a general switch that makes variable targets or keepalive universally correct. Test those behaviors separately and retain the backend observations that prove the selected URI mapping.

Sources

nginx proxy_pass reference, URI replacement, unchanged request forwarding, variable targets, and regex restrictions, checked 2026-10-15.
nginx core location matching, normalized prefix selection before proxy processing, checked 2026-10-15.
nginx upstream module, named upstream groups and backend selection, checked 2026-10-15.

Routing · XB Field Notes

An nginx prefix is a candidate until matching finishes

When it breaks

Check it quickly

Review the selected handler and its later transitions

Sources

Anycast lets routing select a replica

One address, many announcements

Routing performs the failover

Stateful sessions mind the move

When it breaks

Check it quickly

Further reading

Sources

BGP aggregation shrinks the routing table

What aggregation actually buys

Preserve a clear origin

When it breaks

Check it quickly

Sources

A default route matches broadly; it does not rescue every failed path

When it breaks

Check it quickly

Inspect the exact flow before editing defaults

Sources

BGP is the Internet routing table

The AS path carries history and policy

Compare the same prefix first

When it breaks

Check it quickly

Sources

proxy_pass maps the URI as well as selecting an upstream

When it breaks

Check it quickly

Treat each public-to-backend mapping as a contract

Further reading

Sources