Dear all,

I am trying to account for all implicit withdrawal messages within a certain period of time looking at BGP update messages collected at rrc, Ripe. 

Implicit Withdrawal Definition: If the sender announces a route to a currently reachable address and the new route is identical to the current route, this is a duplicate announcement. Otherwise, the sender is replacing the current route with a new route and this is an implicit withdrawal. (Wang et al. in the "Observation and Analysis of BGP iBehavior under Stress")

 

What I am trying to understand is how do I count implicit withdrawals? If for example, I have 4 BGP messages shown below that have same IP address and different AS-PATH attribute, how many implicit withdrawals do I have? Is it 3? If I look at consecutive messages that have same IP address and different AS-PATH attribute the result would be 3 (I compare first to the second, second to the third and third to the fourth – assuming they have same IP address and different AS-PATH I increment implicit withdrawals). But I have come across a solution that takes a first message and compares it to the rest of the messages. Than second message compares to the rest of the messages. And lastly compares the third to the fourth. In this case number of implicit withdrawals is 6. Please advise.

Thanks for your help.

TIME: 2001-9-16 00:00:06

TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP

FROM: 192.65.185.144

TO: 192.65.185.40

BGP PACKET TYPE: UPDATE

ORIGIN: IGP

AS_PATH: 6893 8938 1 297

NEXT_HOP: 192.65.185.144

ANNOUNCED: 192.152.102.0/24

 

TIME: 2001-9-16 00:00:18

TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP

FROM: 192.65.184.3

TO: 192.65.185.40

BGP PACKET TYPE: UPDATE

ORIGIN: IGP

AS_PATH: 513 10764 6509 297

NEXT_HOP: 192.65.185.9

ANNOUNCED: 192.152.102.0/24

 

TIME: 2001-9-16 00:00:36

TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP

FROM: 192.65.185.144

TO: 192.65.185.40

BGP PACKET TYPE: UPDATE

ORIGIN: IGP

AS_PATH: 6893 3561 209 297

NEXT_HOP: 192.65.185.144

ANNOUNCED: 192.152.102.0/24

 

TIME: 2001-9-16 00:00:44

TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP

FROM: 192.65.185.130

TO: 192.65.185.40

BGP PACKET TYPE: UPDATE

ORIGIN: IGP

AS_PATH: 559 8933 6509 297

NEXT_HOP: 192.65.185.130

ANNOUNCED: 192.152.102.0/24