Making Route Flap Damping Usable
Extracted elements (13)
A suppress threshold of 6,000 reduces the BGP update rate by 19% compared to no RFD, while damping 90% fewer prefixes than the default 2,000 threshold. This demonstrates that a higher threshold effectively targets chronic flappers while sparing normally converging prefixes.
Measurements showed only 3% of prefixes were responsible for 36% of BGP messages at a router with real feeds, implying that only very frequently flapping prefixes should be damped. The recommended values target this small fraction without penalizing normal convergence.
RFD was found to severely penalize well-connected sites because topological richness amplifies the number of BGP update messages exchanged, causing many operators to disable RFD entirely. This document recommends parameter adjustments rather than algorithmic overhaul to reduce risk with minimal change.
The goal is minimal change to ameliorate the danger of current RFD implementations, explicitly not a panacea or deep approach to flap reduction. This conservative scope is chosen to reduce implementation risk and preserve backward compatibility with existing operational configurations.
Cisco defaults use a Suppress Threshold of 2,000 and Re-Advertisement penalty of 0, while Juniper defaults use 3,000 and 1,000 respectively. There is currently no consensus on a single set of default RFD parameter values across implementations.
Conservative operators SHOULD configure the Suppress Threshold to no less than 12,000, resulting in only 0.22% of prefixes being damped with an average hourly update reduction of 11%.
Existing BGP implementations SHOULD NOT change their default RFD parameter values in order not to break existing operational configurations.
Implementations MAY provide a test mode where operators can observe the results of a particular RFD configuration without actually damping any prefixes, enabling fine-tuning without loss of reachability.
Operators wanting damping that is less destructive but still somewhat aggressive SHOULD configure the Suppress Threshold to no less than 6,000, which reduces damped prefixes by 90% compared to the default 2,000 threshold.
The internal constant for the maximum penalty value MUST be raised to at least 50,000 to prevent the computed penalty from being artificially capped at values too low for effective discrimination between chronic flappers and normal convergence.
RFD parameters common to all implementations include: Withdrawal penalty (1,000), Re-Advertisement penalty (0 or 1,000), Attribute Change penalty (500), Suppress Threshold (2,000–3,000), Half-Life (15 min), Reuse Threshold (750), and Max Suppress Time (60 min). Some are operator-tunable; others are fixed.
The 'computed maximum penalty' is an upper bound imposed by the RFD parameters and the implementation's sampling rate. Separately, implementations have an internal 'maximum penalty' constant that the current computed penalty may not exceed.
An attacker can generate false flapping to cause a victim's prefix(es) to be damped. The more conservative parameter values recommended by this document slightly mitigate false-flap attacks compared to the aggressive defaults, and should not increase risk.