Border gateway protocol (BGP), the de facto standard used for interdomain routing, is a key enabler for interconnecting largely autonomous IP-subnetwork domains into large IP-networks. Since data transfer may not be possible until stable routes are learned, it is not only critical for BGP to converge after any policy or topology changes, but it is important that the convergence be rapid. Unfortunately, the distributed and asynchronous nature of BGP in conjunction with local policies makes it difficult to analyze, particularly with respect to convergence behavior. We present a novel model which, to our knowledge, is the first one to permit analysis of convergence in the aggregate (i.e., over all message exchange orders between routers regarding route advertisements), rather than worst case behavior. We introduce the notion of probabilistic safety as requiring the probability of convergence to be 1. We provide a necessary and sufficient condition characterizing probabilistic safety that shows that probabilistic safety accommodates BGP configurations whose potential divergence stems solely from pathological message sequences. More generally, we show how to compute for any BGP configuration its probability of convergence. For probabilistically safe configurations, we present procedures for computing their expected time to converge as well as the probability distribution on their convergence times. The ability to compute these quantitative characteristics makes our work ''constructive'' and provides the basis for further understanding and deriving procedures for optimizing network characteristics. Finally, we simulate behavior of several networks and verify the consistency between our analysis and the simulations.