2. The Selection Algorithm Hierarchy

When a $\text{BGP}$ router receives multiple routes to the same prefix, it applies the following tie-breaking rules in order. The first rule that produces a single winner stops the process. This deterministic nature ensures that every router in an $\text{AS}$ (ideally) makes the same decision, preventing routing loops.

3. BGP at the Industrial Edge: The Power Grid Backbone

In critical infrastructure (UTILITIES/GRID), BGP is often used to manage the connectivity of substations. Unlike typical IT environments, these locations rely on "Deterministic Failover." If a primary fiber link to a high-voltage transformer station is lost, the BGP path selection must reconverge onto a secondary microwave or LTE link without dropping the SCADA (Supervisory Control and Data Acquisition) session.

CMRP professionals focus on the **AVAILABILITY** component of the OEE (Overall Equipment Effectiveness) metric. In this context, BGP is not just a protocol; it is a reliability engine. A poorly tuned BGP timer can lead to 180 seconds of "black hole" traffic during a path switch, which is unacceptable for power grid stability monitoring.

4. Maintenance Strategy: BGP Change Management

From a Facility Manager's (CFM) perspective, the networking backbone is as vital as the HVAC or Power distribution. When upgrading a core router, the "Standard Operating Procedure" (SOP) involves manipulating BGP attributes to gracefully drain traffic before the hardware is touched.

By increasing the MED or decreasing the Local Preference on a router slated for maintenance, you "push" traffic toward redundant nodes. This is equivalent to "Lock-Out Tag-Out" (LOTO) in electrical maintenance—you are ensuring the path is clear and isolated before performing the work.

5. Mathematical Influence: AS-Path Prepending

Network engineers often use "AS-Path Prepending" to discourage inbound traffic from choosing a specific link. By artificially inflating the AS-Path length, the path becomes less attractive to the selection algorithm.

Where $N$ is the number of times the local $\text{AS}$ number is repeated in the path attribute. This is the primary mechanism for controlling ingress traffic when you have multiple $\text{ISP}$ connections and want to keep one as a standby.

14. BGP Add-Path: Multi-Path Advertisement and Diverse Path Selection

Standard BGP (RFC 4271) enforces the Best Path Only rule: a router advertises only its single best path for each prefix to its neighbors. This simplifies global routing but hides backup paths. When the best path fails, the router must withdraw the prefix and advertise a new one — requiring a BGP UPDATE message, network propagation, and a new best-path computation on every downstream router. This sequential process adds seconds to convergence.

BGP Add-Path (RFC 7911) relaxes the Best Path Only constraint by allowing a router to advertise multiple paths for the same prefix in a single UPDATE. The path diversity is communicated via a Path Identifier — a 32-bit opaque value attached to each NLRI (Network Layer Reachability Information) entry. The Path Identifier is unique per path but has no semantic meaning; it is simply a discriminator that allows the receiver to distinguish between multiple paths for the same prefix.

The Add-Path capability is negotiated during the BGP OPEN message using a Capabilities Advertisement (Code 2, with AFI/SAFI for the specific address family). After negotiation, the sender can include multiple $\\langle \\text{Path Identifier, Prefix} \\rangle$ pairs in a single UPDATE message. The Path Identifier is prepended to the prefix in the NLRI field:

The receiving router stores all advertised paths in its Adj-RIB-In and runs the standard best-path selection algorithm on each path independently. The additional paths serve as pre-computed backup paths: when the current best path disappears, the router immediately promotes the next-best path from its Adj-RIB-In without waiting for a new UPDATE from the neighbor. In lab tests documented by the IETF, Add-Path reduced median BGP convergence time from 4.2 seconds to 310 ms on a full Internet table of 920,000 prefixes — a 93% improvement.

The Diverse Path Selection Algorithm

When Add-Path provides multiple paths, the router needs a secondary algorithm to decide which additional paths to advertise. RFC 7911 defines the Add-Path Path Selection with four options controlled by the Path Selection ID: (1) advertise all paths from the Adj-RIB-In, (2) advertise one path per neighbor AS, (3) advertise one path per AS-path length, or (4) a customizable route-policy filter. Most implementations use option 3 (diverse AS-path origin) as the default because it provides maximal path diversity with minimal Update churn. The number of additional paths is bounded by the maximum-paths limit, typically configured as 2–8 paths. Exceeding this limit merely means the router stores the additional paths in Adj-RIB-In without advertising them, keeping them available for fast local failover.

15. BGP Flowspec: Traffic Filtering at the Control-Plane Level

BGP Flowspec (RFC 8955/8956) extends BGP to distribute traffic filtering rules — effectively an ACL propagation protocol. Instead of manually configuring an ACL on every edge router in a network (which is error-prone and does not scale), the network operator injects a single Flowspec route into the BGP control plane. The route contains a Flow Specification — a set of Layer 3/Layer 4 matching criteria — and a corresponding Action (e.g., rate-limit, drop, redirect-to-VRF). BGP distributes this rule to all routers in the AS, and each router installs the matching entry in its hardware TCAM.

The Flowspec NLRI Encoding

A Flowspec route's NLRI is encoded as a sequence of Type-Length-Value (TLV) triples. Each type specifies a packet-matching field:

Multiple types can be combined in a single Flowspec rule. For example, to rate-limit all TCP SYN traffic from $10.0.0.0/8$ to $192.168.0.0/16$, the TLV sequence would be {Type2=10.0.0.0/8, Type1=192.168.0.0/16, Type3=6, Type7=SYN}, with the Action set to "rate-limit 1 Mbps". The combination is treated as a logical AND: all conditions must match for the action to apply.

DDoS Mitigation Use Case: The RTBH Extension

The most common Flowspec deployment is DDoS Mitigation using the Redirect-to-Next-Hop action (type 0x8005 — the vendor-specific action code for "discard" or "rate-limit"). When a DDoS attack is detected (e.g., by a scrubbing center or an inline detection appliance), the detection system injects a Flowspec rule carrying the victim's IP prefix with the action "redirect to discard." BGP propagates this rule across the entire AS in seconds, and every edge router installs a TCAM entry that drops all traffic matching the attack flow. This is known as RTBH (Remotely Triggered Black Hole) and is the industry-standard method for mitigating volumetric attacks at the network edge.

The key advantage of Flowspec over traditional ACL-based RTBH is granularity. A standard RTBH uses a static route pointing to $\\text{Null0}$, which drops all traffic to the victim — effectively taking them offline. Flowspec RTBH can drop only the attack traffic (e.g., TCP SYN to a specific port) while allowing legitimate traffic to pass. The difference is the difference between a site-wide outage and a user-specific block. This granularity has made Flowspec the standard for large ISP DDoS mitigation platforms, with NTT Communications, Level 3, and GTT all reporting production Flowspec deployments since 2019.