Network & Infrastructure / BGP Policy & Internet Edge
Maximum-prefix shutdown: distinguish a leak from expected growth
A BGP neighbor drops after a routing-policy update and reports a maximum-prefix event. Raising the limit immediately can accept a leak and conceal the reason the protection triggered.
Environment and inputs: BGP speakers and route reflectors; policy syntax, RPKI integration and address-family behavior depend on the implementation. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record the configured threshold, address family, received and accepted counts, event time and policy diff. Establish whether the implementation counts all received routes or only policy-accepted routes.
Explain the result
Threshold semantics and restart behavior vary by implementation. A sudden jump concentrated in unexpected prefix lengths differs from steady growth inside the approved route inventory.
Plan the fix
If a leak is confirmed, repair filtering at the correct boundary before restoring the session. If growth is legitimate, capacity-plan a reviewed limit with warning headroom.
Check the result and rollback
Verify post-policy counts, route scope and memory use after restoration. Revert the new threshold or policy if unauthorized prefixes appear; retain the original event evidence for capacity review.