What happens when an IP address prefix gets announced or withdrawn. How does this information propagate through the Internet? And how does it affect the amount of Border Gateway Protocol (BGP) traffic across the Internet when a single prefix is freshly announced or withdrawn from the global routing table? The following short analysis shows the detailed effects of these two events.
In the graph below, we can see that all BGP traffic generated after an announcement, occurs in just over one minute after the prefix has been announced. 90% of the volume already occurs in the first 30 seconds. After just a few seconds, the route is already visible to 40% of the Internet. And only after 38 seconds, it has reached 100% visibility.
In the graphs we differentiate between (1) the first update ever sent by a peer regarding this event and (2) further updates from a peer that has already seen the event. This allows us to distinguish between updates that represent the first time they are seen by a peer, and updates that most likely represent route selection (AS path convergence, etc).
We further observed that BGP route updates tend to converge globally in just a few minutes. The propagation of newly announced prefixes happens almost instantaneously, reaching 50% visibility within 10 seconds, revealing a highly responsive global system. Prefix withdrawals take longer to converge and generate nearly 4 times more BGP traffic, with the visibility dropping below 10% only after approximately 2 minutes.
For more background information, including some more graphs and the methodology, please refer to "The Shape of a BGP Update”. There we also show how a prefix withdrawal behaves compared to an announcement when propagating through the Internet.
By Daniel Karrenberg, Chief Scientist at the RIPE NCC
|Cybersquatting||Policy & Regulation|
|DNS Security||Registry Services|
|IP Addressing||White Space|
Minds + Machines
Neustar DDoS Protection
Neustar DNS Services