MED and community fluctuation

I understand the usage and application of MED and community attributes. But we watch some interesting policy/attribute fluctuation of MED and community. We analyze BGP updates sent out by RouteViews peers. We observed a lot of AADupType2 instabilities. We define AADupType2 event as: A route is implicitly withdrawn and replaced with a duplicate of the original route. The two messages have the same NEXTHOP and ASPATH attribute, but differ between at least one other attribute (like MED). Note that we only pair two updates from the same RouteViews' peer / neighboring AS. A fine-grained analysis revealed that most AADupType2 instabilities just change the MED or community attribute (or both), which means that MED and community values associated with prefixes are changing dynamically and frequently. We are not claiming it is a common practice of the Internet, this is just the cases observed from RouteViews peers. We are thinking of the motivation of doing this? Why the ISPs configured their network so that the MED values oscillate? Did ISPs configure MED values dynamically calculated from IGP metrics? The most strange thing to us is why the community attribute associated with prefixes also oscillate frequently. We know that community are used to simply operational complexity: group a set of prefixes to apply the same policy. It didn't make sense to me to change it dynamically. Misconfigurations? Any comments or discussions? Thanks! Zhen Wu

On Fri, Oct 08, 2004 at 11:40:54AM -0700, Zhen Wu wrote:
We are thinking of the motivation of doing this?
Traffic enginneering.
Why the ISPs configured their network so that the MED values oscillate?
Is there actually persistant oscillation, or just "frequent change" with some peers at some periods of time?
Did ISPs configure MED values dynamically calculated from IGP metrics?
This may very well the reason. At least Cisco and Juniper offer the option to derive MED from IGP metric.
The most strange thing to us is why the community attribute associated with prefixes also oscillate frequently. [...] Misconfigurations?
Possibly. Routes received via different ingress points being tagged differently (e.g. country/city based scheme) and due to backbone topology changes, a different "version" of the route becoming "best" and thus announced to the looking glass. Or routes received via multiple ingress points and some missing the ingress tagging due to misconfigured route-map/policies. Same outcome. Best regards, Daniel -- CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0

On Fri, Oct 08, 2004 at 08:49:22PM +0200, Daniel Roesen wrote:
On Fri, Oct 08, 2004 at 11:40:54AM -0700, Zhen Wu wrote:
We are thinking of the motivation of doing this?
Traffic enginneering.
I should have elaborated: to encourage the peer to perform cold-potato routing towards you. Best regards, Daniel -- CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0
participants (2)
-
Daniel Roesen
-
Zhen Wu