advanced24 min studyLesson 197 in Engineering

Anycast locality is determined by routing

Explain shared service addresses, routing catchments, health-driven advertisements, and the state-continuity risks of anycast path changes.

On this page

What you’ll understand

  • Distinguish anycast service selection from geographic nearest-site selection.
  • Explain how advertisements and routing policy define a catchment.
  • Analyze the effect of route changes on stateful sessions.

Anycast makes the same service address reachable from multiple places and lets routing deliver packets to one of them. That can bring a service closer in network terms and provide alternatives when a site withdraws its route. The word closer needs care: routing follows configured metrics and policies, not a latitude-and-longitude calculator. A nearby city can lose to a distant site under the actual advertisements. Treat locality, health, capacity, and connection continuity as distinct design questions.

A shared address has multiple routing origins

An anycast deployment advertises reachability to a shared service address or covering prefix from several service locations. From a particular client, the routing system selects a path and therefore a receiving location. The set of clients whose current paths lead to one location is often called its catchment. A catchment can change when a link fails, an announcement is withdrawn, or another network changes policy. It is not necessarily a stable geographic polygon or an equal share of global demand.

Anycast and DNS-based selection operate at different points. DNS can return different addresses according to its policy and cache behavior; anycast can keep the address identical while routing changes the receiving site. Combining them does not erase either layer's failure modes. To investigate locality, record the client's network, the returned address, the actual receiving site, and the relevant routes. A traceroute alone may not identify the serving process or its current load, so include application-level site identification where appropriate.

Ci(t)={c:route⁡(c,a,t) delivers to site i}\mathcal{C}_i(t)=\{c:\operatorname{route}(c,a,t)\ \text{delivers to site }i\}
C_i(t) is a conceptual catchment for shared address a at time t. c identifies a client network context. This definition describes routing outcome, not geographic distance, equal traffic splitting, or a promise that every client is currently reachable.↔ Scroll wide equations horizontally.

Health must influence advertisement deliberately

A site can have a healthy router while its service is unable to answer useful requests. Continuing to advertise the anycast prefix may then draw clients into a blackhole at the application layer. Conversely, withdrawing a route for every brief noisy health check can create churn and move too much traffic elsewhere. Connect advertisement decisions to explicit health criteria, observation windows, and available fallback capacity. Test the withdrawal path as well as normal service, because a detector without a functioning routing action does not restore reachability.

Multiple sites improve availability only when failures and routing behavior permit the alternatives to help. Shared dependencies, configuration pushes, or upstream providers can fail together. Even with an independently healthy site somewhere, clients may still route to an unhealthy advertiser until withdrawal propagates. An ideal independent-site calculation is therefore a useful benchmark for assumptions, not a production SLA. Verify both that an alternative exists and that affected clients actually move to it under the tested failure.

Aideal=1−(1−a)nA_{\rm ideal}=1-(1-a)^n
For n independent sites each available with probability a, this is the probability that at least one is available. Interpreting it as service availability additionally assumes routing always delivers to an available site and capacity is sufficient; actual anycast does not automatically satisfy those assumptions.↔ Scroll wide equations horizontally.

A route change can move an existing flow

A transport connection can begin at one site and later have packets delivered to another after a routing change. The new site may lack the original connection's state, so using the same destination address does not guarantee continuity. Per-flow forwarding stability on one router also cannot guarantee that every network on a changing path keeps the same site. Short stateless exchanges and long-lived stateful sessions therefore place different demands on the deployment. State sharing, flow handoff, or connection-aware redirection require explicit mechanisms beyond anycast itself.

Use the probability lab with p interpreted as independent site availability and n as site count. Predict the zero-available-sites bar and compare its complement with the ideal formula. The bars enumerate a binomial model; they do not choose a route, model correlated regional failures, or retain transport state. Then name a real deployment condition that would prevent an available site from rescuing a client. This separates redundancy on paper from tested failover and makes the limits of the calculation visible.

Calculate an ideal redundancy benchmark

Three sites each have independent availability 0.9 in a hypothetical interval. Assume instant correct selection of an available site and adequate capacity. Calculate the ideal availability, then relax the selection assumption.

  1. One site's unavailability probability is 1 − 0.9 = 0.1. Independence makes simultaneous unavailability 0.1³ = 0.001 for all three sites.

  2. Take the complement: at least one site is available with probability 1 − 0.001 = 0.999, or 99.9%. This is the stated ideal event, not an observed deployment result.

  3. If routing keeps some clients attached to a failed advertiser, an available site elsewhere does not necessarily serve those clients. Their realized availability can fall below 99.9%, even though the independent site-health calculation is unchanged.

The result

The ideal benchmark is 99.9%. Actual service availability also requires timely correct failover, sufficient remaining capacity, and justified dependence assumptions.

Explore the model

Interactive lab

Interactive lab · probability

Available somewhere is not delivered everywhere

Set p to an assumed independent per-site availability and n to site count. Predict the zero-success bar and its complement. The model does not implement anycast catchments, withdrawal delays, correlated failures, or connection state.

Available somewhere is not delivered everywhereThese are exact binomial probabilities for independent trials with one fixed success probability. Playback tours the distribution; it does not resample outcomes. Current readings: Mean · np: 5; Variance · np(1−p): 2.5; Total probability: 1. All parameters are adjustable with the labeled controls below.03581000.070.150.220.3Successes kP(X = k)k = 0 · P = 9.77e-4
Exact probabilityHighlighted outcomeMean np
Mean · np
5
Variance · np(1−p)
2.5
Total probability
1
t = 0 s

These are exact binomial probabilities for independent trials with one fixed success probability. Playback tours the distribution; it does not resample outcomes. Parameter changes pause playback and recompute the model at the current elapsed time. Reset restores both parameters and returns time to zero. Playback starts paused. Adjust either parameter, then choose Play or Step.

Look forRedundancy produces a useful availability bound only after routing and capacity assumptions are made explicit.

Check your understanding

What does an anycast address guarantee about the physical location that serves a client?

Try it yourself

An anycast TCP flow works through site A. A route change delivers its next packet to site B, which has no shared connection state. Why can the flow fail even though B is healthy?

Take a moment to make a prediction or work it out on paper. Open a hint when you need one.

Give me a hint

A destination address identifies where packets can be sent; a transport connection also depends on state established by earlier packets.

Compare with the solution

B may not recognize the connection's sequence and transport state because its handshake occurred at A. A healthy process at B can therefore reject or fail to continue the flow. Anycast alone does not migrate state. Test stateful failover explicitly and choose a continuity mechanism or application retry strategy appropriate to the workload, rather than assuming address stability implies connection stability.

Take it with you

  • Anycast catchments reflect routing topology and policy rather than geography alone.
  • An application health failure must trigger an effective and capacity-aware routing response.
  • A stable shared address does not guarantee stable receiving-site or connection state.

Read further

Original sources and deeper explanations to follow at your own pace.

Optional progress, saved in this browser when available. Revisit any lesson at any time.

Lesson not marked complete.