ISPs, Transit, Peering, IXPs and Autonomous Systems
- The Internet is thousands of independently owned networks, each an autonomous system (AS) with its own number (ASN), joined by business agreements. No one owns the whole thing.
- Two kinds of link carry the money story. Transit: a customer pays a provider to reach the rest of the Internet. Peering: two networks swap traffic between their own customers, usually settlement-free (no money either way).
- A Tier-1 network is one that reaches the whole Internet without buying transit from anyone. It is defined by what it does not pay for, not by being biggest.
- An IXP is a shared switch fabric where many networks plug in once and can peer with many others, which shortens paths and cuts transit bills.
- Peering is a commercial deal, not a law of nature. When two networks fall out and unplug the link, customers who depend on that link can lose reachability, as happened to Cogent and Telia customers in 2008.
Mental model
Airlines. Buying transit is buying a ticket on someone else's plane: you pay, and they take you anywhere their network flies. Peering is two airlines agreeing to carry each other's passengers on their own routes for free, because both gain. An IXP is a shared hub airport where many airlines park next to each other, so one gate lease reaches a dozen partners instead of negotiating a dozen separate terminals.
Where it breaks: airline codeshares are public and contractual per ticket. Internet peering is private, rarely published, and is only free while both sides feel the traffic and cost balance looks fair. Either side can end it, and passengers whose only route ran through that agreement are stranded.
A supplier and consumer graph. Each AS is a service, each link is an edge, and every edge is labelled either pays (customer to provider) or free (peer to peer). Routing policy is then a rule over those labels: send traffic over the cheapest edge you are allowed to use. If you know vendor contracts versus open-source dependencies, transit is the paid SLA, peering is a mutual-benefit sharing agreement.
Where it breaks: in a dependency graph, a missing edge makes a build fail loudly. A missing peering edge usually just reroutes traffic over a longer, costlier path, and fails only for networks that had no other path.
How it works
What is the Internet introduced the core as a set of ISP networks, exchange points and backbones. Packet switching covered how packets cross it. This page covers who connects to whom and who pays.
Tiers and who pays
No single network reaches everywhere, so networks buy or trade reachability. Roughly:
- Access ISPs are the providers your edge connects to directly (your home or mobile carrier). They sell connectivity to end users and buy transit upstream.
- Regional ISPs aggregate many access networks across a region and also buy transit from a larger network.
- Tier-1 networks reach every destination on the Internet without buying transit. They get there by peering settlement-free with every other Tier-1. Only a small group of networks qualifies, and the membership is a convention, not a registry: see CAIDA's AS Rank, which infers a top clique of transit-free networks from public BGP data.
Money flows up along transit links (customer pays provider) and nowhere along settlement-free peering links.
Peering at an IXP
An Internet exchange point is a building (often a few buildings in one metro area) with one or more Ethernet switches. Each member brings a router, buys a port on the switch (the speeds on offer are in the IXP's own price list), and can then exchange traffic with any other member over the same fabric. Two ways to set up sessions:
- Bilateral sessions: you agree a BGP session with each partner one by one.
- Route server: the IXP runs a server that every member peers with once and that relays routes between members (RFC 7947). One session reaches everyone who opted in.
The switch only carries traffic between members. It does not decide who may talk to whom; that is policy in each member's BGP configuration (mechanics on BGP and inter-AS routing).
Autonomous systems and ASNs
An autonomous system is, in RFC 1930's words, a connected group of one or more IP prefixes run by one or more network operators with a single, clearly defined routing policy. Each AS has an autonomous system number (ASN), allocated through the regional Internet registries. ASNs started as 16-bit numbers; RFC 6793 extended them to 32 bits (4-byte ASNs) because the 16-bit space ran short. BGP exchanges routes between ASes, and the AS path in a route is the list of ASNs it crossed; the mechanics are owned by BGP.
How many ASes exist moves constantly, so look at the live counts: CIDR Report and Geoff Huston's BGP table statistics.
Worked example: buy 10 Gbps of transit or peer at an IXP
Transit is billed per unit of traffic. TeleGeography reports that in Q2 2026 the lowest 10 GigE IP transit price in the most competitive markets held at $0.07 per Mbps per month (excluding local access and installation). Typical prices elsewhere are higher, so this is a floor, not an average.
- Transit: 10 Gbps is 10,000 Mbps. At the floor price, 10,000 x $0.07 = $700 per month.
- Peering: the cost is mostly fixed per month, not per Mbps. It is the IXP port fee, the cross-connect or transport to reach the IXP, and the rack space and router port. Call that fixed total
F. - Peering is cheaper once the traffic you can hand to peers instead of a transit provider exceeds
F / 0.07Mbps.
This page does not know your F; the IXP's price list and your colocation quote do. As an illustration only, if F were $700 per month, the break-even is 700 / 0.07 = 10,000 Mbps = 10 Gbps. Below that, transit is cheaper; above it, every extra Mbps sent to peers is nearly free. This is why large networks peer heavily and small ones often just buy transit.
Deep dive
Customer-provider and peer-peer relationships
Every adjacent AS pair has a business relationship, and BGP policy follows it (Gao, 2001 is the standard paper on inferring these relationships).
| Relationship | Money flow | Routes exported to the other side |
|---|---|---|
| Customer to provider (transit) | Customer pays provider | Customer exports its own routes and its customers' routes. Provider exports everything it knows. |
| Peer to peer (settlement-free) | None | Each exports only its own routes and its customers' routes, not its providers' or other peers'. |
| Peer to peer (paid peering) | One side pays the other | Same routes as settlement-free peering. Only the money differs. |
The consequence is the valley-free rule: a route learned from a provider or peer is not passed on to another provider or peer, because that would mean carrying traffic for free. A path therefore climbs customer-to-provider links, crosses at most one peer link, then descends provider-to-customer links. The BGP page owns the mechanics and worked example: Policy and business relationships.
Transit, private peering and IXP peering compared
| Transit | Private peering (PNI) | IXP peering | |
|---|---|---|---|
| Who pays | Customer pays provider, usually per Mbps or per port | Usually nobody for the interconnect itself, each side pays its own port and cross-connect. Paid peering exists. | Each member pays the IXP for a port, and its own transport and router. Sessions are normally free. |
| Scope | Whole Internet via the provider | Only the two networks and their customers | Every member you peer with, and only their customers |
| Port speed | Negotiated with the provider | A dedicated link, sized to the traffic between the two | Whatever port you buy on the shared fabric |
| Typical user | Access ISPs, enterprises, small networks | Pairs with a lot of traffic between them, such as a content network and a large eyeball ISP | Networks that want many peers cheaply |
| Control | Provider sets terms, you pick among providers | Full control of the link, bilateral terms | Shared fabric, IXP rules apply, many partners |
Settlement-free conditions, paid peering and remote peering
Settlement-free peering is only free while both sides see value. Networks publish peering policies that typically ask for things like geographic overlap, minimum traffic, and a reasonably balanced ratio, and many networks list their policy in PeeringDB. A network that sends far more than it receives may be asked to pay (paid peering) or to buy transit. Remote peering means reaching an IXP through a reseller or a long circuit without placing your own router in its building, which is cheaper and slower to set up than a local presence.
Route servers, filtering and MANRS
Anyone on a shared fabric can announce anything, so peering sessions need hygiene. RFC 7454 (BGP operations and security) covers the baseline: filter the prefixes you accept from a peer, and cap how many a peer may send. The MANRS initiative publishes a shared set of routing-security actions that member networks and IXPs commit to. Leaks and hijacks, and what stops them, belong to the BGP pages, not here.
Textbook vs real world
| The textbook says | Production does | Why |
|---|---|---|
| Traffic climbs access, regional, then Tier-1, then descends. | Large content networks peer directly with eyeball ISPs, often in-region, so traffic skips the upper tiers. | A direct path is shorter, cheaper than per-Mbps transit once volume is high, and lets the content network control performance. |
| Peering is free. | Settlement-free peering needs both sides to see balanced value, and paid peering and disputes exist. | Networks charge when traffic is lopsided because one side carries the other's bits further. |
| Tier-1 means the biggest. | Tier-1 means no transit bill. Other networks can be larger by traffic and still buy transit somewhere. | The definition is commercial: who pays whom. |
| Peering means a direct cable. | Often it is a BGP session across a shared IXP switch. | Cheaper, and one port reaches many partners. |
In production
- Netflix offers ISPs Open Connect appliances to install inside the ISP's own network, as well as peering, so popular video is served from inside the access network (Open Connect).
- Google hosts Google Global Cache nodes inside ISP networks and publishes its peering and infrastructure information (Google Peering).
- Cloudflare publishes a peering policy describing which networks it peers with and on what terms (Cloudflare peering policy).
- IXPs publish live traffic. Do not quote a frozen peak: read the current graphs at AMS-IX, DE-CIX and LINX. Euro-IX lists exchanges worldwide, and PeeringDB is where networks register their facilities, ports and peering policies.
How a CDN decides which cache serves you, and anycast, are owned by CDN and Global traffic steering. Typical latency and capacity figures for paths and links are on Latency and capacity numbers.
History and evolution
- 1995 The NSFNET backbone, the US academic core, was decommissioned and replaced by commercial providers that interconnected at network access points (NAPs); early exchanges such as MAE-East were the first shared meeting places (NSFNET). What broke: there was no single backbone any more, so interconnection became a commercial negotiation.
- 2008 Cogent and Telia (AS 1299) stopped exchanging traffic and their networks lost mutual connectivity from late on 13 March (The Local; GigaOM reported it on 14 March) until it was restored on the evening of 28 March 2008. Sources: GigaOM report, 14 March 2008 and The Local, 30 March 2008. Telia's customer letter, reproduced in the first source, said Cogent had "partitioned the Internet" between the two networks' customers.
- 2014 In February 2014 Netflix began agreeing direct connections to US ISPs, starting with Comcast, whose customers had complained of frequent buffering. It was an early high-profile direct interconnection between a content network and an eyeball ISP, and a public dispute over who should bear the cost (Netflix, Wikipedia, with press citations).
- Now Content networks peer directly or place caches inside ISPs, and exchange operators publish live traffic dashboards (see In production).
- Next More private interconnects between large networks and more in-ISP caching; LEO satellite constellations are becoming access ISPs in their own right, with their own transit and peering.
Hands-on
Find which AS originates an address, using Team Cymru's whois service (works on macOS and Linux):
The same data over DNS: reverse the IP octets and append origin.asn.cymru.com (the four octets of 8.8.8.8 happen to reverse to themselves):
Look up an ASN's peers, prefixes and upstreams in a browser at https://bgp.he.net/AS15169.
Show the AS of each hop. macOS traceroute -a prints the ASN in brackets; on Linux use mtr -z or traceroute -A:
Output is abbreviated, and hostnames are removed. [AS0] is a private address with no origin AS. Read the column as a path of owners: your home network, your ISP's AS for several hops, then a jump to the AS that owns the destination (AS13335 is Cloudflare). A hop where the AS changes is where traffic crossed from one network to another, whether by transit or peering. Rows of * are hops that did not answer, which says nothing about the path being broken (see traceroute). The IP-to-AS mapping is a best guess and can mislabel hops on interconnect links.
Gotchas
Interview questions
Show answer
In transit, a customer pays a provider to carry its traffic to the rest of the Internet. In peering, two networks exchange traffic destined for each other's own customers, usually with no money changing hands. The provider's reach is the whole Internet; a peer's reach is only the peer and its customers.
Follow-ups:
- When does a company choose each? Transit for universal reach and simplicity. Peering once traffic to a given network is large enough that the fixed cost of the link beats the per-Mbps transit bill, as in the worked example above.
- Can peering replace transit entirely? Only for a Tier-1, which peers with every other Tier-1 to cover the Internet. Everyone else needs at least one transit provider for the rest.
Show answer
An Internet exchange point is a shared switch fabric where many networks connect once and can peer with any other member. Joining shortens paths, keeps local traffic local, and offloads traffic from paid transit.
Follow-ups:
- Route server versus bilateral sessions? A route server relays routes so one BGP session reaches many members (RFC 7947). Bilateral sessions are set up one partner at a time and give you per-partner control of terms and policy.
- Does the IXP route traffic? No. It forwards Ethernet frames between members. Routing is each member's BGP policy.
Show answer
An autonomous system is a set of IP prefixes under one operator with a single clearly defined routing policy (RFC 1930). Its ASN is the number that identifies it in BGP paths. ASNs are 32 bits since RFC 6793.
Follow-ups:
- How many exist roughly? It changes constantly, so check the live counts at the CIDR Report or potaroo rather than a remembered number.
- Can I use any ASN internally? Private-use ranges are reserved in RFC 6996 and must not leak to the public Internet.
Show answer
A Tier-1 reaches every destination without buying transit, by peering settlement-free with every other Tier-1. Peering is a contract, so yes, one can be depeered.
Follow-ups:
- What happened in the 2008 case? Cogent and Telia stopped exchanging traffic, and the two networks lost mutual connectivity from late on 13 March until 28 March 2008, per the sources in the History section.
- Who is hurt? Customers whose only path to the other network ran across that link. Networks with other paths to both sides can route around the break.
Show answer
Content networks now carry a large fraction of traffic, so it pays them to deliver it from caches close to users and to peer directly with access ISPs instead of buying transit through the tiers. The path from content to eyeball is shorter and under the content network's control.
Follow-ups:
- What is an in-ISP cache? A server owned by a content network (such as a Netflix Open Connect appliance or a Google Global Cache node) placed inside the access ISP's network, so the content never crosses a peering or transit link. See CDN.
- What does it cost the ISP? Space, power and operations for hardware it does not own, in exchange for less transit and a better customer experience.
Show answer
Multihome: buy transit from two providers and run BGP to both, so if one fails the other still carries traffic. That needs your own ASN and address space you can announce yourself (provider-independent space), both from your regional registry, plus a router that can hold the BGP sessions.
Follow-ups:
- What does it cost? A second transit contract and port, registry fees, a BGP-capable router, and someone who can operate BGP. Peering at an IXP can later cut the transit bill.
- Is a second link from the same provider enough? It protects against a cable or port failure, not against that provider failing as a whole.
- What prefix size can I announce? Conventionally networks filter very small announcements, with
/24for IPv4 and/48for IPv6 commonly the longest accepted. Check your upstreams' filters.
Fun facts
- AMS-IX, DE-CIX and LINX publish live traffic graphs, so you can watch an exchange's load move through the day.
- Telia's AS number is 1299, and the 2008 dispute lasted about two weeks (late 13 March to 28 March), according to the sources cited above.
- 4-byte ASN support uses a placeholder,
AS_TRANS(AS 23456), so older routers that only understand 16-bit numbers still see a valid AS number (RFC 6793). - Your
traceroutecan show you AS boundaries in a few seconds with-a, no special access needed.
Cheat sheet
- Need to reach everything, no negotiation: buy transit.
- Lots of traffic to one big network: private peering (PNI) with it.
- Lots of small and medium partners in one metro: join an IXP, use a route server.
- Only one upstream today: multihome before it fails, not after.