Convergence, Stability and Propagation Dynamics

Author

K19G

Updated

October 31, 2026

Convergence, Stability and Propagation Dynamics

The global routing system is never in a perfectly static state. Across tens of thousands of networks, physical fiber cuts, hardware reboots, BFD timeouts, and maintenance windows trigger a continuous stream of BGP updates and withdrawals. Understanding how these updates ripple through the planetary topology—and how that dynamics can be weaponized—is essential for securing the routing control plane.

Convergence Time and Global Propagation Delays

Convergence is the process by which all routers across the Internet transition from an old state to an agreed new consistent forwarding state following a topology change.

Unlike IGP link-state databases that synchronize in tens of milliseconds, interdomain BGP convergence operates on the order of seconds to minutes. The total delay is governed by four factors:

\[T_{\text{convergence}} = \sum (T_{\text{processing}} + T_{\text{MRAI}} + T_{\text{queuing}} + T_{\text{propagation}})\]

  1. Minimum Route Advertisement Interval (MRAI, RFC 4271): To prevent routers from bombarding neighbors with continuous updates during a flap, BGP enforces a rate-limiting timer on eBGP sessions (historically default: 30 seconds; modern implementations allow 5 seconds or 0 seconds). A router cannot send successive updates for the same prefix until the MRAI timer expires.
  2. Path Exploration (BGP Hunting): When a preferred path is withdrawn, a router does not immediately know that backup paths traversing the same failing link are also broken. It will iteratively explore each candidate path in order of length, advertising and withdrawing multiple intermediate paths before settling on the true surviving route.
  3. Propagation Delay: Speed-of-light delays across transoceanic fiber links (e.g., London to Singapore: ~160 ms round-trip).

Route Flapping and Dampening (RFC 2439)

A route flap occurs when a prefix is repeatedly advertised and withdrawn in rapid succession. Left unchecked, a single flapping prefix on a flapping DSL line or unstable BGP session would force hundreds of thousands of routers worldwide to continuously recompute their FIBs.

To combat this, BGP Route Flap Dampening (RFD, RFC 2439) was introduced: - Every time a route flaps, the router adds a numerical penalty (typically \(1000\)). - If the penalty exceeds a configured Suppress Threshold (e.g., \(2000\)), the route is suppressed: the router stops using it and stops advertising it to peers, even if it is currently advertised as reachable. - While suppressed, the penalty decays exponentially according to a Half-Life timer (e.g., 15 minutes). - Once the penalty falls below a Reuse Threshold (e.g., \(750\)), the route is unsuppressed and restored to service.

Penalty
   ^
   |        +-- Flap 2 (Penalty = 2000) -> SUPPRESSED
   |       / \
   |      /   \ 
   |     /     \ Exponential Decay (Half-Life = 15m)
   |    +-- Flap 1 (Penalty = 1000)
   |   /         \
   +----------------------------------------------------> Time
              Reuse Threshold (750) -> RE-ENABLED

[!CAUTION] The RFD Trap: In the early 2000s, measurement research (Mao et al.) revealed that normal BGP path exploration during a single failover event caused benign prefixes to flap 3–5 times within seconds. Aggressive RFD suppressed legitimate networks for hours. Consequently, RIPE-378 and RFC 7454 advise operators to either disable RFD entirely or set conservative thresholds that only trigger on persistent, sustained oscillations.

Hot Potato Routing and Path Instability

In Hot-Potato Routing, an Autonomous System sheds outbound traffic at the closest exit router according to its internal IGP metric.

While computationally efficient, hot-potato routing ties interdomain forwarding decisions directly to intradomain topology. A link flap inside an ISP’s internal backbone can shift the lowest IGP metric from Exit Router \(A\) in Chicago to Exit Router \(B\) in Dallas. Because BGP recomputes the best path, the ISP sends an UPDATE with a changed NEXT_HOP to external peers, triggering global route churn despite the external destination remaining entirely stable.

Slow Convergence as an Attack Surface

The latency of interdomain convergence creates significant operational and security vulnerabilities:

  1. Transient Forwarding Loops and Blackholes: During the minutes when Router \(A\) has converged to a new path but downstream Router \(B\) is still evaluating an old path, packets can bounce between routers in a transient loop or be dropped into a blackhole until TTL expires.
  2. Volumetric Churn Attacks: An adversary with control of a flapping BGP speaker can intentionally cycle announcements and withdrawals at intervals timed to defeat MRAI filters, forcing upstream route processors to continuously consume CPU cycles in state recalculation.
  3. Attack Opportunity Window: In an intentional origin hijacking attack, the minutes taken for global looking glasses and monitoring systems to converge and alert operators give attackers an uncontested window to intercept credentials or siphon cryptocurrency.

Measurement Data on Convergence Behavior

Data gathered from global route collection projects (RIPE RIS, RouteViews, CAIDA) indicates: - Up-Convergence (a newly announced prefix becoming globally reachable): typically achieves 95% global visibility within 10 to 45 seconds. - Down-Convergence (withdrawing an active prefix): can take 90 to 240 seconds due to path exploration across Tier-1 networks. - Over 60% of observed global routing updates are duplicate announcements or attribute modifications that do not change the underlying forwarding next-hop.