Method and apparatus for out of path border gateway protocol validation

A system for out of path border gateway protocol (BGP) validation, the system comprising:

• a non-route path server including a BGP monitor;
• and
• a first physical router including a BGP monitor, wherein the first physical router being in a network and is configured to receive inbound prefix announcements from a second router in a different network and deny acceptance of the inbound prefix announcements, wherein the BGP monitor of the first physical router configured to retrieve and send the inbound prefix announcements to the BGP monitor of the non-route path server, and wherein the non-route path server is configured to:
• validate the inbound prefix announcements by comparing a validation score with a threshold, where the validation score is based on a plurality of route path tests applied to the inbound prefix announcements;
• send, via the BGP monitor of the non-route path server to the first physical router, a validation notification in response to the comparing;
• and
• program the first physical router with a validated inbound prefix announcement of the inbound prefix announcements based on the validation notification being associated with a positive validation.

A method for out of path border gateway protocol (BGP) validation, the method comprising:

• receiving, at a BGP monitor at an out of path server from a BGP monitor at a first router of a network, a denied inbound prefix announcement sent via a BGP monitoring protocol, wherein the denied inbound prefix announcement is an inbound prefix announcement received by the first router from a second router of a different network and being denied acceptance by the first router;
• computing, at the out of path server, a validation score for the denied inbound prefix announcement by applying a plurality of validation tests to the denied inbound prefix announcement;
• comparing, at the out of path server, the validation score against a security threshold;
• sending, by the BGP monitor at the out of path server to the first router, a validation notification in response to the comparing;
• and
• programming, by the out of path server, the first router with the denied inbound prefix announcement based on the validation notification being associated with a positive validation.