Behind the Routes: Measuring BGP Instability on the Internet#

Milena Bueno Rocha (FURG, Brazil; slides co-authored with Pedro Marcos)

• Why: Systematic baseline data on how much BGP churn is real change versus noise — directly useful to anyone building BGP monitoring, anomaly detection, or dashboards, and a good calibration against "BGP is melting" narratives.
• What: Fifteen days (April 2026) of RIBs plus updates from RRC00 (Amsterdam) and RRC24 (Montevideo), filtered to full-table monitors, analyzed across Global / LACNIC / Panama scopes. Findings: over 60% of updates globally are effective routing changes (LACNIC-region announcements reach 81.7% — the highest of the three scopes); AS_PATH and COMMUNITIES dominate attribute changes (~95% of effective updates); over 96% of effective updates modify at most 2 attributes; MED and NEXT_HOP changes are negligible; and propagation is mostly local — 50% of IPv4 changes are seen by fewer than 10 monitors, while IPv6 changes propagate more widely (80% of changes reach ≤26 monitors).
• How: Updates classified as effective changes / redundant / withdrawals; per-update attribute diffs; propagation measured by counting how many full-table monitors observe the same per-prefix change within a 120-second window, aggregated into CDFs. Regional scoping uses LACNIC delegated files.
• Where applicable: BGP monitoring and anomaly-detection design generally; fully reproducible from public RIS/RouteViews data. The authors flag the open next question: who is causing the instability.