1

I am analyzing certain BGP update messages and normally, an average BGP message(withdrawal) could contain 2-3 prefixes. During my analyses, i noticed that there are some few withdrawal updates that contain up to about 500 prefixes. Is it normal to have such size of prefixes withdrawn in one message ? And could this intuitively mean something ?

  • Why the downvote ? – iseesharp May 13 '14 at 12:31
  • I didn't downvote, but the question seems to be attempting to speculate about other bgp events with insufficient information – Mike Pennington May 13 '14 at 13:03
2

There are many reasons for a lot of withdrawals. All you can guess from such an event is: "Somewhere upstream an event caused some change in the BGP routing."

Could be a peer disconnecting/dropping a BGP session, an IXP (Internet Exchange Point) going down, or a lot of other things.

Don't forget that BGP is spanning the whole globe. 500 withdrawals are not such a big thing compared to the whole internet.

If you want to know what happened you would have to look at the individual withdrawals and look for patterns (all from the same origin AS, all coming over the same upstream/IXP, etc.). Even then the exact reason(s) might still be unclear.

| improve this answer | |
2

If a AS has a single peering point with another customer ASN, learning 500 prefixes from that customer, and that session goes down, it could trigger a mass withdrawl.

| improve this answer | |
  • There are multiple reasons for 500 prefix withdrawals. Peer down could be one of them – user5025 May 13 '14 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.