[rbak-nsp] BGP Flapping after flag recive

Tue Jan 30 08:17:15 EST 2018

By manually decoding I can see it's AS Path 9002 3223 200651 (200651 being 3.4043 for a SmartEdge), prefix 185.100.84.0/23, with an aggregator attribute that seems fine, and two communities.
I don't see what is wrong, though, but it would be necessary to check every field and notably the lengths and so on.

> Le 30 janv. 2018 à 13:57, Marcin Kuczera <marcin at leon.pl> a écrit :
> 
> On 2018-01-30 13:23, Michał Przywuski wrote:
>> I found something like this :
>> 
>> [BGP]Dareek#sh bgp malform update
>> Jan 30 02:34:31 Malformed UPDATE msg (nbr 87.245.245.128, context 0x4008010a, 77 bytes, repeated 14 times, reason: Invalid msg) - 
>>  ffff ffff ffff ffff ffff ffff ffff ffff 004d 0200 0000 3240 0101 0040 020e 0203 0000 232a 0000 0c97 0003 0fcb 4003 0457 f5f5 80e0 0708 0003 0fcb 5d72 28a2 c008 0823 
>> 2a23 2a23 2afc 9117 b964 54
> 
> So, take RFC and try to analyse this.
> Or maybe somehow try to import it into wireshark..
> 
> Marcin
> 
> 
>> 
>> W dniu 30.01.2018 o 13:06, Olivier Benghozi pisze:
>>> In 2011 the issue was with an AGGREGATOR attribute with AS 0.
>>> 
>>> So it's something else here.
>>> Maybe like https://lists.gt.net/nsp/juniper/35537 <https://lists.gt.net/nsp/juniper/35537> ?
>>> 
>>> You'll have to capture the session and/or debug bgp on the Smartedge to have some more information about the route at problem, I guess.
>>> 
>>>> Le 30 janv. 2018 à 12:54, Michał Przywuski <mprzywuski at jmdi.pl <mailto:mprzywuski at jmdi.pl>> a écrit :
>>>> 
>>>> Hi , my device and log.
>>>> 
>>>> [local]Dareek#sh ver
>>>> 
>>>> Redback Networks SmartEdge OS Version SEOS-12.1.1.11p7-Release
>>>> Built by sysbuild at eussjlx7065.sj.us.am.ericsson.se <mailto:sysbuild at eussjlx7065.sj.us.am.ericsson.se> Mon May 2 02:42:56 PDT 2016
>>>> Copyright (C) 1998-2016, Redback Networks Inc. All rights reserved.
>>>> System Bootstrap version is Mips,rev2.0.2.69
>>>> Installed minikernel version is 11.7
>>>> Router Up Time -   40 days, 9 hours 21 minutes 33 secs
>>>> 
>>>> 
>>>> Jan 30 02:25:54 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=3414
>>>> Jan 30 02:26:43 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 UP
>>>> Jan 30 02:27:20 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 DOWN - Notification sent
>>>> Jan 30 02:27:20 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=2579
>>>> Jan 30 02:28:18 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 UP
>>>> Jan 30 02:28:49 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 DOWN - Notification sent
>>>> Jan 30 02:28:49 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=2267
>>>> Jan 30 02:29:40 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 UP
>>>> Jan 30 02:30:21 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 DOWN - Notification sent
>>>> Jan 30 02:30:21 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=4185
>>>> Jan 30 02:31:08 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 UP
>>>> Jan 30 02:31:48 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 DOWN - Notification sent
>>>> Jan 30 02:31:48 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=2637
>>>> Jan 30 02:32:36 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 UP
>>>> Jan 30 02:33:06 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 DOWN - Notification sent
>>>> Jan 30 02:33:06 10.15.1.1 [0266]: %BGP-6-INFO: 87.245.245.128 send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=2709
>>>> 
>>>> 
>>>> W dniu 30.01.2018 o 12:29, Olivier Benghozi pisze:
>>>>> Update version. It was some 6.x stuff, in 2011, so it's very old now.
>>>>> 
>>>>>> Le 30 janv. 2018 à 12:17, Michał Przywuski <mprzywuski at jmdi.pl <mailto:mprzywuski at jmdi.pl>> a écrit :
>>>>>> 
>>>>>> Hi , i have a problem with BGP flapping , one of peer send us notification and after that ower session flap. I know some peapole also have problem with that (https://mailman.nanog.org/pipermail/nanog/2011-December/042537.html <https://mailman.nanog.org/pipermail/nanog/2011-December/042537.html>). Do you know how to fix it ?
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> redback-nsp mailing list
>>> redback-nsp at puck.nether.net <mailto:redback-nsp at puck.nether.net>
>>> https://puck.nether.net/mailman/listinfo/redback-nsp <https://puck.nether.net/mailman/listinfo/redback-nsp>
>> 
>> -- 
>> 
>> Michał Przywuski
>> Administrator sieci. 
>> 
>> 
>> _______________________________________________
>> redback-nsp mailing list
>> redback-nsp at puck.nether.net <mailto:redback-nsp at puck.nether.net>
>> https://puck.nether.net/mailman/listinfo/redback-nsp <https://puck.nether.net/mailman/listinfo/redback-nsp>
> 
> -- 
> Marcin Kuczera / Wiceprezes Zarządu / CTO
> +48 32 440 80 71/ marcin.kuczera at leon.pl <mailto:marcin.kuczera at leon.pl>
> Leon Sp. z o.o. 
> ul. Kilińskiego 33d, 44-200 Rybnik 
> http://www.leon.pl/ <http://www.leon.pl/>
> INTERNET | TELEWIZJA | TELEFON
> 
> KRS 0000223101 Sąd Rejonowy w Gliwicach
> Kapitał zakładowy 576.700 zł
> NIP: 6332068698
> 
> _______________________________________________
> redback-nsp mailing list
> redback-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/redback-nsp

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/redback-nsp/attachments/20180130/08571d00/attachment-0001.html>