[c-nsp] Identifying BGP route flapping

[Frank Bulk - iNAME]

You're right, a transient sub-50 msec hit should not be enough to interrupt
a BGP session, but we believe that in this occurrence of the SONET
protection mechanism had some kind of negative effect.  They do protection
switches more often (road construction, etc), I'm told, and we've never had
an issue.  My guess is that the protection switch affected the Ethernet port
on their transport equipment feeding their PE Ethernet switch which feeds
our router (so there is a "buffer" between their equipment and ours.  What's
interesting is that the "fix" was to bounce the Ethernet port on the router
facing us.  They told us that they did not touch anything else on their
transport equipment.

They opened up a case with Cisco TAC, but because our upstream provider
resolved the issue Cisco didn't have an opportunity to do any deep
diagnoses.

I'm open to any other creative speculation.

Frank

-----Original Message-----
From: Robert Blayzor [mailto:rblayzor at inoc.net] 
Sent: Thursday, April 10, 2008 7:24 PM
To: frnkblk at iname.com
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Identifying BGP route flapping

On Apr 10, 2008, at 4:24 PM, Frank Bulk wrote:
> Yes, there was an event that caused the router flapping to happen,
> but it
> was clearly an anomaly.  There was a sub-50 msec interruption in
> Ethernet
> traffic on the upstream for one router that caused the two routers
> (connected with each other over a separate link) to go haywire.

Would a transient sub-50msec hit actually be enough to interrupt a BGP
session?  Or is the physical interface flapping state and causing the
peer to reset?

--
Robert Blayzor, BOFH
INOC, LLC
rblayzor at inoc.net
http://www.inoc.net/~rblayzor/

Mac OS X. Because making Unix user-friendly is easier than debugging
Windows.