IP transit is a wholesale internet service: an upstream network carries your traffic to every other network on the internet and announces your IP addresses so the rest of the internet can reach you. You connect a router to the provider, exchange routes with it using Border Gateway Protocol (BGP), and pay for the capacity you use. It is how hosting companies, SaaS platforms, internet service providers, and larger enterprises with their own address space get onto the internet.
At a glance
- Transit buys reachability: one connection that reaches every destination on the internet, inbound and outbound.
- It is delivered as a port (for example 1, 10 or 100 Gbps) in a data center or carrier facility, with routes exchanged over BGP.
- Pricing is usually per Mbps on a committed rate, with usage above the commit often billed at the 95th percentile.
- Route quality, latency to your users, and the provider’s own connections to other networks matter as much as the price per Mbps.
- Most serious deployments use two or more transit providers for resilience.
What problem it solves
No single network reaches the whole internet on its own. Content you host, customers you serve, and partners you exchange data with sit on thousands of other networks. Building direct connections to all of them is impossible, so you pay a larger network that already has those connections to carry your traffic the rest of the way. That is transit.
For a business that runs its own platform or data center, transit also solves control. With your own address space and autonomous system number (ASN), you can buy transit from more than one provider, announce the same addresses to each, and keep running if one of them fails. You decide how traffic enters and leaves your network instead of depending on one provider’s default setup.
How it works
The connection. The provider hands off a port, usually in a colocation facility or carrier hotel where both of you already have equipment, connected by a cross-connect. Some providers also deliver transit over a longer circuit to your site.
Routing. Your router and the provider’s router run a BGP session. You announce the address blocks you are allowed to use; the provider checks them against registry records and route filters, then passes them to the rest of the internet. In return the provider sends you either a full internet routing table, a partial table (its own customers’ routes), or just a default route, depending on what your equipment can handle and how much control you want.
Traffic engineering. Providers publish BGP communities, which are tags you attach to your announcements to influence how they treat your routes, such as lowering their preference or not announcing them in a given region. Combined with techniques like AS-path prepending, these let you shift inbound traffic between providers.
Billing. Most transit is sold as a committed data rate on a larger port. The provider samples your traffic through the month, and usage above the commit is typically billed using the 95th percentile method, so occasional spikes do not drive the bill. Some providers sell flat-rate ports instead. Prices and terms vary widely by market and volume.
Security. Good providers filter the routes customers announce, validate them against Resource Public Key Infrastructure (RPKI) and internet routing registry records, and offer DDoS mitigation that can scrub attack traffic before it reaches your port.
When it matters for buyers
- You run a platform that customers reach over the internet. Their experience depends on how well your transit providers connect to their networks, not just on your own servers.
- You have, or are getting, your own address space and ASN. Transit from at least two providers is the usual way to use it.
- You are opening or moving a data center. Transit options differ by building. Carrier-neutral facilities usually let you choose from several providers and add peering at a nearby internet exchange.
- Your traffic is growing or changing shape. Commit levels, burst charges and port sizes set at the last renewal may no longer fit.
- You have been hit by a DDoS attack. Upstream mitigation from your transit provider, or a separate scrubbing service, protects the port itself.
For more on comparing providers and designing a multi-homed edge, see our IP Transit solution page.
Questions to ask vendors
- Do you provide a full table, partial table or default route, and is there an extra charge for any of them?
- Which BGP communities do you support for traffic engineering, and where are they documented?
- Do you validate customer and peer routes with RPKI and filter against routing registries?
- What is the committed rate, how is usage above it billed, and how are samples taken?
- What latency and packet-loss commitments are in the SLA, and between which points are they measured?
- How well do you connect to the networks our users are on, and in which regions are you weakest?
- Is DDoS mitigation included, optional, or a separate contract, and how is it triggered?
- Which physical path and building entry does this port use, and how is it separated from our other provider?
How it differs from IP transport
The names are close, but they buy different things. IP transit buys reachability: an upstream network carries your traffic to, and announces your routes to, the entire internet. It is usually priced per Mbps, often on a committed rate with bursting billed at the 95th percentile. IP transport buys a path: a circuit or carrier service (for example a wavelength, Ethernet or MPLS service) that moves IP traffic between two or more of your own points, such as a data center and an office. Transport on its own gives you no internet reachability. Many networks use transport to haul traffic back to the location where they buy transit, so the two often appear on the same order but answer different questions: “how do we reach the internet?” versus “how do we connect our own sites?”
Problems this helps with
- Our own IP addresses need to stay reachable if one provider goes down
- Bills that spike whenever traffic bursts
- Customers in some regions see slow or unreliable access to our platform
