I am analyzing certain BGP update messages and normally, an average BGP message(withdrawal) could contain 2-3 prefixes. During my analyses, i noticed that there are some few withdrawal updates that contain up to about 500 prefixes. Is it normal to have such size of prefixes withdrawn in one message ? And could this intuitively mean something ?
-
Why the downvote ?– iseesharpMay 13, 2014 at 12:31
-
I didn't downvote, but the question seems to be attempting to speculate about other bgp events with insufficient information– Mike PenningtonMay 13, 2014 at 13:03
Add a comment
|
2 Answers
There are many reasons for a lot of withdrawals. All you can guess from such an event is: "Somewhere upstream an event caused some change in the BGP routing."
Could be a peer disconnecting/dropping a BGP session, an IXP (Internet Exchange Point) going down, or a lot of other things.
Don't forget that BGP is spanning the whole globe. 500 withdrawals are not such a big thing compared to the whole internet.
If you want to know what happened you would have to look at the individual withdrawals and look for patterns (all from the same origin AS, all coming over the same upstream/IXP, etc.). Even then the exact reason(s) might still be unclear.
answered May 15, 2014 at 6:59
If a AS has a single peering point with another customer ASN, learning 500 prefixes from that customer, and that session goes down, it could trigger a mass withdrawl.
-
There are multiple reasons for 500 prefix withdrawals. Peer down could be one of them– user5025May 13, 2014 at 20:28