Of the many routing protocols, BGP is the routing protocol of the Internet. BGP works by advertising or announcing routing paths to its peer routers. For example, when a BGP router receives information about the path to reach a destination prefix, the BGP protocol announces the route to its peers. When a new best path is available to reach the same destination, the earlier route is withdrawn using a BGP update message and the new route is announced. But there are instances when a BGP route can flap, which means that the route is not reliable enough to send traffic. In this blog, we examine route flapping and how to detect BGP route flaps.
BGP route flapping describes the situation when a BGP router advertising routes to a destination, repeatedly and rapidly alternates between one route and another as the best path to reach the destination. It may also advertise a route as unavailable and then available again. Route flapping is usually caused due to hardware or software errors on the router, configuration errors, or errors in communication links.
The repeated advertisement of routes to a destination by a BGP router causes its neighbor BGP routers to update their routing tables as well, leading to even more BGP routing advertisements being sent back and forth to other peer BGP routers in the network. The result is frequent recalculation of topology by all participating BGP routers. This can quickly affect the overall performance of the network as the repeated route withdrawal and announcement results in the routers using more CPU and memory, as well as increased network latency and delayed network convergence.
There are two ways to control BGP route flapping. One solution is to limit the flapping to a small portion of the network and is referred to as route summarization or aggregation. The other method is route dampening.
Route summarization (or route aggregation) is a method where multiple network numbers are aggregated into a single summary address. Route summarization is normally used to manage the growth of routing tables and thus save CPU, memory and bandwidth. But this has an added advantage where, when one of the summarized routes is flapping, the summary route that includes all the routes does not change, and thus other BGP peers receiving these advertisements do not have to update their routing tables with every flap.
Route dampening (Route Damping as per RFC2439) is another method used to minimize the propagation of route flaps across the network. A route dampening feature is built into BGP implementations and can be used to mitigate the effects of BGP route flapping.
When a router flaps, its routing updates are exponentially decayed. Thus, when a BGP router advertises a withdraw and an update message for a route, it is considered as a flap and a numeric value is assigned to that route as a penalty. The default penalty for a route flap is 1000 and this value is incremented each time the router flaps till it reaches the suppress limit. When the penalty exceeds the suppress limit, the route is dampened and the prefixes are not announced anymore. After the prefix is stable and there are no more route flaps, the penalty value is reduced until it reaches the reuse limit after which the prefix is again announced. For a detailed explanation on route dampening check out this article: https://supportforums.cisco.com/t5/network-infrastructure-blogs/bgp-route-dampening-confused/ba-p/3101999
Given the repercussions that BGP route flaps can have on a network, it is important to know when a route flap occurs and the BGP routes affected. This can be done using route analytics software that collects IGP and BGP routing information. The information collected includes the network topology, routing paths and the BGP route advertisements. Using information from the BGP route advertisements, which includes both the BGP withdraw and update messages, route analytics software can help detect BGP route flaps.
With this information, the mean time to identify (MTTI) and repair (MTTR) route flap conditions can be greatly reduced.