The Mechanism of Penalty and Suppression
RFD operates on a simple arithmetic model of trust. Each time a route flaps, a penalty value is added to the route's historical record in the local BGP process. If the cumulative penalty crosses a specific 'suppress threshold,' the router stops advertising that route to its peers. The penalty then decays over time according to a half-life algorithm. Only when the penalty falls below a 'reuse threshold' is the route once again considered valid for propagation.
Penalty Assignment: Every withdrawal or change in path attributes triggers a penalty increase (often 1000 points per flap).
Exponential Decay: The penalty value decreases over a configured half-life (typically 15-60 minutes), allowing the route to recover if stability returns.
Suppression: Once the penalty exceeds the threshold, the route remains unreachable, regardless of its actual state, until the decay brings it back into the usable range.
Trade-offs and Operational Risks
While RFD protects the control plane, it introduces the risk of 'false positives.' If the thresholds are too aggressive, legitimate convergence events—such as maintenance or legitimate re-routing—can trigger prolonged blackholes. Because BGP is a distributed system, a route suppressed by one ISP might be reachable through another, leading to inconsistent reachability globally. Modern practice often suggests conservative damping settings or avoiding it entirely on core backbone links where convergence speed is prioritized over CPU protection.
Engineers must balance the necessity of control plane stability against the operational requirement for rapid re-convergence. Understanding the decay curve and the specific penalty weights allows for tuning that mitigates transient noise without sacrificing global connectivity.
