The normal route
Four autonomous systems (ASes): networks, each with its own AS number. A owns the address block 203.0.113.0/24. B and D carry traffic. H is a fourth network that is about to claim A's addresses.
A sends B a BGP UPDATE: "203.0.113.0/24, reach it through me". The AS_PATH is just 64496. The last number in an AS_PATH is the origin: the AS where the route starts.
B puts its own number in front and tells D: AS_PATH 64497 64496. The origin is still 64496, A. D adds 203.0.113.0/24 via B to its routing table.
A user in D opens A's website at 203.0.113.10. D's only matching route is 203.0.113.0/24 via B, so the packets go D to B to A. All is well.
The hijack
H announces 203.0.113.0/25, half of A's block, with itself as the origin: AS_PATH 64510. It could be a typo or an attack. Plain BGP cannot check who owns an address, so D believes it.
D now has two routes that cover 203.0.113.10: /24 via B and /25 via H. Routers always forward on the longest matching prefix, and /25 is more specific. Local preference and path length are never compared.
Packets for 203.0.113.10 now flow to H instead of A. H can drop them, so A's site vanishes for D's users, or look at them. Nothing on the user's screen says the route changed.
In February 2008 Pakistan Telecom announced a more specific part of YouTube's addresses to block YouTube at home. Its provider passed the route on, and much of the internet sent YouTube traffic to Pakistan for about two hours.
The defence: RPKI
The defence is RPKI. A's regional internet registry certifies that A holds 203.0.113.0/24. With that certificate A signs a Route Origin Authorization (ROA): only AS64496 may originate this block, no longer than /24.
D runs a validator. It downloads ROAs from the public RPKI repositories, checks every signature back to the registry, and hands D's routers a short list: 203.0.113.0/24, max /24, origin AS64496.
H announces 203.0.113.0/25 again. D's router checks it against the list: wrong origin AS, and longer than /24. So the route is Invalid, and D's policy drops it. This check is Route Origin Validation (ROV).
A's own route via B is Valid: origin AS64496, length /24. Packets for 203.0.113.10 keep flowing D to B to A. ROV checks only the origin AS; checking the whole path needs further defences.
The messages, field by field
;; step 1/12 · cast · local ;; at A, B, H, D A · AS64496 Origin network · owns 203.0.113.0/24 B · AS64497 Transit network H · AS64510 Hijacker D · AS64499 Your ISP · owns 198.51.100.0/24 links: A–B A pays B for transit B–D peers: nobody pays H–D H pays D for transit (H is D's customer) AS numbers 64496-64511 are reserved for documentation (RFC 5398).
AS numbers 64496-64511 (RFC 5398) and the prefixes 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737) are reserved for documentation. ROV only labels routes. Dropping Invalid routes is each network's own policy (RFC 8481); a hijack is stopped only where networks do it.