Convergence: measuring what your network actually does

Convergence is the time between a failure and the network having a working path again. It gets quoted from vendor documentation far more often than it gets measured, and measured numbers are usually worse.

What the time is made of

Detection — noticing the failure. This usually dominates. A cable pulled from a router is detected immediately by loss of carrier. A failure two hops away behind a switch is detected only when hello timers expire, which with OSPF defaults means up to forty seconds.

Propagation — telling everyone else. Computation — recalculating paths. Installation — programming the forwarding hardware, which on a large table is not instant.

Attack detection first

Tuning hello timers helps but costs CPU and risks false positives on a busy link. Bidirectional Forwarding Detection is the better answer: a lightweight protocol that detects failure in milliseconds and tells the routing protocol.

interface Gi0/1
 bfd interval 300 min_rx 300 multiplier 3
router ospf 1
 bfd all-interfaces

Measure it honestly

Do not time it with a ping and a stopwatch. Send a continuous stream at a known rate, break the link, and count what was lost:

ping -i 0.01 -c 3000 destination | tail -3
# 10 ms interval: each lost packet is 10 ms of outage

Test the failure you actually fear. Pulling a cable is the easy case. Test a device losing power, a line card failing, a link that stays up while the far end is dead, and a partial failure where some traffic passes.

The uncomfortable finding

Most networks that claim fast failover have only ever been tested by unplugging a cable. The silent-failure case — link up, far end dead — is both the most common in practice and the slowest to detect, because nothing signals it. If you test one scenario, test that one.