Re: [sidr] Burstiness of BGP updates (was: WGLC: draft-ietf-sidr-bgpsec-reqs)

"Sriram, Kotikalapudi" <> Mon, 14 November 2011 11:14 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1F70E11E8234 for <>; Mon, 14 Nov 2011 03:14:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.212
X-Spam-Status: No, score=-6.212 tagged_above=-999 required=5 tests=[AWL=0.160, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SARE_SUB_OBFU_Q1=0.227]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id NKAFIOYu6g3j for <>; Mon, 14 Nov 2011 03:14:12 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 1DF0911E81E8 for <>; Mon, 14 Nov 2011 03:14:11 -0800 (PST)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.1.339.1; Mon, 14 Nov 2011 06:14:08 -0500
Received: from ([fe80::41df:f63f:c718:e08]) by ([]) with mapi; Mon, 14 Nov 2011 06:13:32 -0500
From: "Sriram, Kotikalapudi" <>
To: Brian Dickson <>
Date: Mon, 14 Nov 2011 06:13:32 -0500
Thread-Topic: [sidr] Burstiness of BGP updates (was: WGLC: draft-ietf-sidr-bgpsec-reqs)
Thread-Index: AQHMor5xosDF2n1HPkGttBtzThsGyQ==
Message-ID: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Cc: sidr wg list <>
Subject: Re: [sidr] Burstiness of BGP updates (was: WGLC: draft-ietf-sidr-bgpsec-reqs)
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 14 Nov 2011 11:14:13 -0000

For BGP-4 updates, Geoff does provide the peak numbers observed
for prefix updates in 1 second intervals.
For example: 
Peak Prefix Update Rate per second:  1539   
Average Prefix Updates per second:  2.76 
I suspect the peak perhaps corresponds to BGP session reset events
when updates are generated back-to-back.
If you exclude those reset events, then BGP-4 chattiness 
will have low variance. 
Since we do not have operational BGPSEC yet, we cannot obtain similar
measurements at present. But I am confident that if you focus on BGPSEC 
chattiness only due to beaconing (i.e., exclude BGP session resets events),
then the burstiness (of BGPSEC beacons alone) will be low.
Bear in mind that the protocol recommends beacons should be jittered
in time, and when thousands of prefixes are beaconed in a time-jittered
fashion from distributed sites, they smooth out 
and the resulting beacon arrival process at a router
would be a rather smooth Poisson process (variance/mean = 1).
So the peak # beacons in n-second intervals (for n>=1) will likely be a small 
multiple of the mean # beacons in n-second intervals. 
Again mind you, on the otherhand, if BGPSEC session resets occur, then that
would be quite different -- thousands of BGPSEC updates (not beacons) 
would be sent back-to-back in that case between the two affected peers. 
It may be noted that operators are anyway used to allowing 10s of seconds for 
table convergence after session resets.
(You will see an analysis of convergence following BGPSEC session reset 
in the presentation that Randy and I have in the SIDR WG meeting tomorrow.)   

>From: Brian Dickson []
>Hi, Sriram,
>Could you supply similar kinds of numbers, but with "peak" instead of
>"average", esp. 50%ile, 75%ile,  and 95%-ile levels for "peak"?
>Average is much less important than peak, in my experience.
>Steady-state is easy.
>Also, in noisy/spiky data, mean != median typically. BGP is noisy/spiky.
>(Also when doing percentiles, it is essential to say, "95%ile on
>5-minute samples, over a period of 1 week" for instance - and those
>would be the customary sample windows to use.)