What decides how much of a flood each site absorbs when one address is announced from many sites?

## You are not the one doing the load balancing The intuition people bring to a footprint announcing one address from many sites is a load balancer: something takes the incoming requests and deals them out. Nothing of the kind exists. You announce the same prefix from each site, and every other network on the internet independently decides which of those announcements it prefers. The set of source networks that pick a given site is that site's *catchment*, and it is chosen entirely by other people's routing policy. ## What actually drives the choice In rough order of how much they decide: - **Local preference inside the source's network.** An operator who prefers its own settlement-free peering over paid transit will send your traffic to whichever of your sites it peers with, even if a transit path leads somewhere closer. - **AS path length**, as a tie-break once preference is equal — fewer networks traversed wins, which correlates weakly with distance and not at all with your capacity. - **Where you peer.** A site connected to a large residential access network will pull that network's whole subscriber base, which can be several times another site's entire catchment. - **Hot-potato exit selection.** A transit network that hears your prefix in several places hands the traffic off at the exit nearest to where it entered, so the split inside one upstream is decided by where its own customers are. Notice what is absent: geographic distance, round-trip time, and any measure of how loaded or how large your sites are. Two sites twenty kilometres apart can have utterly different catchments, and a small site can find itself carrying the largest share. ## Consequence one: shares are lumpy The practical shape of a real footprint is a few sites carrying most of the traffic and a long tail carrying little. When an attack arrives from a botnet whose sources are scattered across many networks, it broadly follows the same lumpiness as ordinary traffic — but not exactly, because the source mix is different. Compromised devices concentrate in particular access networks, and if those networks all prefer one of your sites, that site takes a disproportionate hit while the rest of the estate looks normal. The reverse also happens: an attack from very widely distributed sources spreads more evenly than your user traffic does. ## Consequence two: shares move, and not because of you Catchment is not a property you configured; it is the current state of thousands of other networks' policies. Any of these will move it, silently: - an upstream adjusts local preference or re-homes a customer - a peering session drops, so that network's traffic falls back to transit and exits somewhere else entirely - a new peer is added at one of your sites - an intermediate network changes its own hot-potato exits A site's share can double overnight with no change in the total. If your alerting compares each site to its own learned baseline, that shift looks exactly like an attack — and, worse, the reverse case looks like nothing at all: a site whose share collapses because a peer went away will sit quietly below threshold while the traffic it used to carry is now stressing a neighbour. So the per-site baseline is a moving target. The number worth alerting on is the estate total, with each site's *share* of that total tracked as a separate series — a share that changes sharply while the total is flat tells you routing moved; a share that changes while the total climbs tells you the source mix changed. ## Consequence three: you cannot steer precisely, and shedding does not shed You have blunt influence — you can make a site less attractive by lengthening the path you advertise from it, or stop announcing from it altogether — but you cannot choose which networks land where, and you cannot predict exactly what a change will do until you make it. Most importantly, taking a site out does not remove its traffic from the estate. Every source that was reaching it re-converges on whichever site its routing prefers next, and the flood lands on the neighbours, which may be smaller. "Turn off the site that is struggling" is therefore not a mitigation; it is a redistribution, and it can turn one hot site into two. ## The wrong answer to avoid The common wrong answer in an interview is that traffic goes to the nearest site and divides roughly evenly. It is the intuition the marketing diagram gives you, it is wrong on both halves, and every defensive consequence above follows from it being wrong.