What causes bgp flapping

Overview

Border Gateway Protocol (BGP) is the routing protocol that powers the internet, enabling different autonomous systems (AS) to exchange routing information. BGP flapping refers to a state where a BGP session or specific routes within a BGP session are repeatedly established and torn down, or advertised and withdrawn. This instability can have significant negative impacts on network performance, leading to intermittent connectivity, increased latency, and potential service disruptions for end-users. Understanding the causes of BGP flapping is crucial for network administrators to maintain a stable and reliable internet infrastructure.

What is BGP?

Before delving into flapping, it's important to understand BGP's role. BGP is a path-vector routing protocol. Unlike interior gateway protocols (IGPs) that focus on finding the fastest path within a single network, BGP's primary goal is to exchange reachability information between different networks (Autonomous Systems). ASes are large networks, often operated by Internet Service Providers (ISPs) or major enterprises, that have a unified routing policy. BGP routers exchange information about which IP prefixes (blocks of IP addresses) are reachable through their AS and what the 'path' (sequence of ASes) is to reach them. This path information is critical for making routing decisions that consider factors beyond just hop count, such as policy, cost, and stability.

What is BGP Flapping?

BGP flapping is characterized by the continuous or recurring instability of BGP sessions or routes. This can manifest in several ways:

• Session Flapping: The TCP connection (typically on port 179) between two BGP peers is repeatedly established and closed.
• Route Flapping: Specific network prefixes are advertised by a BGP speaker, then withdrawn, then advertised again, and so on. This is often more subtle than session flapping but can be just as disruptive.

The underlying issue is that BGP has mechanisms to detect and react to network changes. However, when these changes are frequent, erroneous, or triggered by faulty equipment or configurations, the protocol can enter a state of instability, leading to repeated state transitions that are collectively known as flapping.

Common Causes of BGP Flapping

BGP flapping is rarely caused by a single factor; it's often a combination of issues. Here are the most common culprits:

1. Network Misconfigurations

This is perhaps the most frequent cause. Errors in router configuration can lead to BGP instability:

• Incorrect AS Path Prepending: Intentionally making a path seem longer to influence traffic. If misapplied, it can cause routes to be withdrawn and re-advertised as the router tries to find the 'best' path.
• Route Filtering Issues: Incorrectly configured route maps or prefix lists can cause legitimate routes to be filtered out and then re-advertised when the filter is corrected or bypassed.
• Loop Prevention Mechanisms: While designed to prevent routing loops, misconfigurations in how BGP handles AS_PATH or other attributes can sometimes trigger flapping.
• Peer Configuration Mismatches: Differences in configurations between BGP peers, such as mismatched authentication passwords, timers, or capabilities, can lead to frequent session resets.

2. Hardware and Software Issues

Faulty hardware or software bugs can also be significant contributors:

• Router Hardware Failures: Malfunctioning line cards, memory errors, or CPU overloads on routers can cause BGP processes to crash or restart, leading to session drops and route flapping.
• Software Bugs: Bugs in the BGP implementation of a router's operating system can lead to unpredictable behavior, including route instability. This is more common in older or less stable software versions.
• Interface Problems: Flapping physical or logical interfaces on a router can disrupt the underlying network connectivity, causing BGP sessions to drop if the session is tied to that interface.

3. Network Topology Changes

Dynamic changes in the network can trigger BGP instability if not managed carefully:

• Link Failures and Restorations: Rapidly changing network topology, such as frequent link up/down events, can cause BGP to reconverge, potentially leading to flapping if the changes are persistent or cyclical.
• Changes in Peering Agreements: Adding or removing BGP peers, or changes in the policies of existing peers, can affect the routes advertised and received, potentially leading to flapping.
• Load Balancing Issues: Aggressive load balancing techniques that frequently shift traffic between paths can sometimes cause BGP to perceive changes and trigger route withdrawals and re-advertisements.

4. Policy and Business Logic

Commercial and policy decisions can indirectly lead to flapping:

• Customer Route Stability: If a customer or peer network experiences its own internal routing instability, it can propagate to your network via BGP.
• Peering Policy Changes: ISPs may change their peering policies (e.g., filtering specific prefixes, preferring certain paths) which can cause upstream or downstream BGP sessions to flap as routes are affected.
• Route Dampening Misconfiguration: BGP route dampening is a feature designed to penalize unstable routes. If dampening parameters are set too aggressively or inappropriately, it can cause stable routes to be suppressed and then re-advertised, creating a flapping effect.

Impact of BGP Flapping

The consequences of BGP flapping can be severe:

• Intermittent Connectivity: Users may experience dropped connections or be unable to reach certain destinations.
• Increased Latency: As BGP routers constantly re-evaluate paths, traffic can be rerouted inefficiently, increasing delays.
• Reduced Network Throughput: Network devices may spend more time processing BGP updates than forwarding traffic.
• Service Outages: In severe cases, BGP flapping can lead to complete loss of connectivity to certain parts of the internet or for entire networks.

Troubleshooting BGP Flapping

Diagnosing BGP flapping involves meticulous examination of router logs, BGP state tables, and network traffic. Tools like 'show ip bgp summary', 'show ip bgp neighbors', and BGP debugging commands are essential. Network engineers often look for patterns in route advertisements and withdrawals, correlate these events with interface status changes, and review recent configuration changes.