I am analyzing certain BGP update messages and normally, an average BGP message(withdrawal) could contain 2-3 prefixes. During my analyses, i noticed that there are some few withdrawal updates that contain up to about 500 prefixes. Is it normal to have such size of prefixes withdrawn in one message ? And could this intuitively mean something ?

  • Why the downvote ?
    – iseesharp
    May 13, 2014 at 12:31
  • I didn't downvote, but the question seems to be attempting to speculate about other bgp events with insufficient information May 13, 2014 at 13:03

2 Answers 2


There are many reasons for a lot of withdrawals. All you can guess from such an event is: "Somewhere upstream an event caused some change in the BGP routing."

Could be a peer disconnecting/dropping a BGP session, an IXP (Internet Exchange Point) going down, or a lot of other things.

Don't forget that BGP is spanning the whole globe. 500 withdrawals are not such a big thing compared to the whole internet.

If you want to know what happened you would have to look at the individual withdrawals and look for patterns (all from the same origin AS, all coming over the same upstream/IXP, etc.). Even then the exact reason(s) might still be unclear.


If a AS has a single peering point with another customer ASN, learning 500 prefixes from that customer, and that session goes down, it could trigger a mass withdrawl.

  • There are multiple reasons for 500 prefix withdrawals. Peer down could be one of them
    – user5025
    May 13, 2014 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.