On the Origins of BGP Path Changes

BGP has been deployed in Internet for more than a decade. However, the events that cause BGP topological changes are not well un- derstood. Although large traces of routing updates seen in BGP operation are collected by RIPE RIS and University of Oregon RouteViews, previous work examines this data set as individual routing updates. This paper de- scribes methods that group routing updates into events. Since one event (a policy change or peering failure) results in many update messages, we clus- ter updates both temporally and topologically (based on the path vector information). We propose a new approach to analyzing the update traces, classifying the topological impact of routing events, and approximating the distance to the the Autonomous System originating the event. Our analy- sis provides some insight into routing behavior: First, at least 50% path changes are caused by events on transit peerings. Second, a significant number (23-38%) of path changes are transient, in that routing updates indicate temporary path changes, but they ultimately converge on a path that is identical from the previously stable path. These observations sug- gest that a content provider cannot guarantee end-to-end routing stability based solely on its relationship with its immediate ISP, and that better de- tection of transient changes may reduce routing overhead.