Correct final routes can contain unsafe transitions

Consider destination D with links A–D cost one, A–B cost one, and B–D cost five. Before failure, A forwards directly to D and B forwards through A at total cost two. After A–D fails, the correct new routes are A through B and B directly to D. The complete old and new states are each sensible for their respective topology. The hazard appears if A installs its new next hop before B replaces its old next hop.

During that interval, A sends packets for D to B, and B sends them back to A. This is a forwarding microloop caused by inconsistent update timing; neither router needs to calculate an incorrect final path. If B changes first, the particular two-router loop is avoided, although other losses may remain. Ordered forwarding updates and repair mechanisms address particular transition cases, but their assumptions and failure coverage must be stated. Merely accelerating one component can change the ordering rather than eliminate every unsafe state.

A local physical indication may detect some failures quickly, while a silent forwarding failure may require another detection method. Information then reaches affected routers, which schedule computation and install resulting entries. These stages can overlap or repeat. A simple sum is appropriate only for a clearly serial model of one critical recovery path. A protocol timer value alone is not a measured bound on user-visible disruption, particularly when forwarding hardware updates or downstream dependencies dominate.

Define the restoration criterion before measuring it. The first successful probe, sustained delivery at the required rate, return-path recovery, and recovery of a long-lived application connection are different events. Synchronize timestamps when comparing devices and account for probe spacing. A probe every second cannot tightly resolve a twenty-millisecond outage. Preserve packet traces and forwarding-installation evidence so an apparent recovery can be connected to the mechanism rather than only to a route announcement.

IPv4 TTL and IPv6 Hop Limit bound how many forwarding hops a packet can survive. Their depletion can remove a circulating packet and may trigger an ICMP time-exceeded response, subject to protocol rules and rate limits. They do not force the routers to agree, repair a failed link, or guarantee that later packets avoid the same loop. A larger initial hop limit can allow more repeated forwarding work while the mixed state persists. Treat it as a containment mechanism, not a convergence accelerator.

Use the queue lab to predict resource pressure during disruption. First press Reset, set both λ=3 and μ=2, predict a positive backlog slope, then Play or Step. Compare a separate run by pressing Reset again, setting both λ=2 and μ=3, predicting a four-second drain from the initial four items, then using Play or Step. Editing rates retains elapsed time and recomputes from the initial four; it does not model a live switch on accumulated work. This is a simplified work-budget view, not a loop topology or packet replication simulator. A real loop can multiply load on particular links and interact with finite buffers, neither of which the lab models. Measure per-interface counters and packet paths to determine whether a real transition has that amplification mechanism.