BGP Flapping Alarm Threshold via Session Aggregation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current route flapping detection methods in BGP networks often result in false positives or missed intermittent conditions due to reliance on single-session logic, leading to undetected network outages and inefficient convergence.

Innovation Solution

Implementing a system that generates multiple BGP session flapping alarms by analyzing multiple links across multiple pairs of local and peer routers, combining information to set a more accurate alarm threshold and alert on fault-impacting BGP session establishment, thereby reducing silent failures and network outage minutes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If a route flapping alarm threshold is set too low, then detection sensitivity is improved, but false positives increase

Engineering Contradiction:

Improvedetection sensitivityVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The patent combines information from multiple BGP sessions into a unified flapping detection mechanism. Instead of monitoring each session independently, the system aggregates state changes across multiple sessions to determine whether to generate an alarm, thereby reducing false positives while maintaining detection sensitivity

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent introduces an intermediary aggregation layer between individual session monitoring and alarm generation. This intermediary collects state change data from multiple sessions, applies correlation logic, and only triggers alarms when flapping patterns are confirmed across the aggregated data, filtering out isolated false positives

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a route flapping alarm threshold is set too high, then false positives are reduced, but intermittent conditions requiring action are missed

Engineering Contradiction:

Improvefalse positive rateVSAvoiddetection sensitivity

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

By merging data from multiple sessions, the system achieves higher confidence in detecting genuine flapping conditions. The aggregation mechanism ensures that intermittent but significant flapping events are captured when they occur across multiple sessions, while ignoring isolated incidents that would trigger false alarms

Inventive Principle:

Principle #5Merging (Combining)

3Device complexity

If single-session logic is used for flapping detection, then device complexity is reduced, but detection accuracy deteriorates

Engineering Contradiction:

Improvedetection logic complexityVSAvoiddetection accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The patent segments the flapping detection problem into two distinct layers: individual session state monitoring and aggregated alarm generation. This segmentation allows each layer to remain relatively simple while the combination provides enhanced detection accuracy, avoiding the need for complex logic in any single component

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS8289856B2Alarm threshold for BGP flapping detection

Publication Date: 2012.10.16 AT&T INTELLECTUAL PROPERTY I L P

AI summary

Methods and systems are described that improve the alarming logic for Border Gateway Protocol (BGP) flapping events. Embodiments provide an alarm threshold on BGP flapping conditions and alert on BGP related events. A reduction in silent failures and network outage minutes is achieved.