[rbak-nsp] BGP Flapping after update with malformed ASPATH

[Wojciech Wrona]

Same thing at TPIX. And it looks like it is the same route *16c395ec* 
I've tried to decode whole BGP update message. It looks like this (if i 
didn't make any mistake):

ffff ffff ffff ffff ffff ffff ffff ffff

004d    # Length 77 bytes
02      # BGP UPDATE

0000

0032    # path atributes length 50 bytes

4001  # Attribute type (ORIGIN)
01    # Attribute length 1 byte
00    # origin type IGP

4002      # Attribute type (AS-PATH)
12        # Attribute length 18 bytes
01        # AS_PATH Type
04        # AS_PATH Segment length: 4 ASes
0000 17d9 # AS6105
0000 183e # AS6206
0000 1840 # AS6208
0000 1967 # AS6503

4003        # Attribute type (NextHop)
04          # Attribute length 4 bytes
c395e964    # Next hop 195.149.233.100


8004        # Attribute type (MULTI_EXIT_DISC)
04          # Attribute length 4 bytes
0000 0000


c007                    # Attribute type (AGGREGATOR)
08                      # Attribute length 8 bytes
0000 735f c395 efff     # Agregated by AS29535 IP: 195.149.239.255


16 c3 95 ec    # route 195.149.236.0/22


As-path looks ok to me, length of AS path is ok, only 2byte ASes there i 
dont see any problem.... Take a look maybe You will notice something.

Best regards,

-- 
Wojciech Wrona

W dniu 29.05.2018 o 11:12, Olga Savinovskaya pisze:
> We have the same problem from yesterday 23:15
>
> I created a ticket at the Atman(problem neighbor) but did not get a 
> response jet.
>
>
> May 29 10:41:01: [0266]: %BGP-6-INFO: 212.91.2.1 send NOTIFICATION: 
> 3/11 (update: malformed ASPATH) with 21 byte data. mxReadMs=1073
>
> May 29 10:41:01 notification msg sent (nbr 212.91.2.1, context 
> 0x4008010a 42 bytes, repeated 192 times, code 3/11 (update: malformed 
> ASPATH) -
>  0000 0000 ffff ffff ffff ffff ffff ffff ffff ffff 002a 0303 0b40 0212 
> 0104 0000 17d9 0000 183e 0000 1840
>
> May 29 10:41:01 Malformed UPDATE msg (nbr 212.91.2.1, context 
> 0x4008010a, 92 bytes, repeated 192 times, reason: Invalid msg) -
>  ffff ffff ffff ffff ffff ffff ffff ffff 005c 0200 0000 4140 0101 0040 
> 0212 0104 0000 17d9 0000 183e 0000 1840 0000 1967 4003 04d4 5b00 1180 
> 0404 0000 0000 c007 0800
>  0073 5fc3 95ef ffc0 080c 1b1b 0009 60ac 735f 735f 0a6b *16c3 95ec *
>
> As i know 16c3 95ec  = 22.195.149.236? But i can't parse from that 
> update what AS makes problem.
>
> SmartEdge OS Version SEOS-12.1.1.11p7-Release
>
> _________________
> Pozdrawiam, Savinovskaya Olga
>
>> Hi everyone,
>> It looks like we've managed to find another strange problem with BGP on
>> SEOS. In the night one of our peers session started to flap with
>> following message:
>> May 29 10:52:01: [0001]: %BGP-6-INFO: 195.149.233.1 UP
>> May 29 10:52:15: [0001]: %BGP-6-INFO: 195.149.233.1 DOWN - Notification sent
>> May 29 10:52:15: [0001]: %BGP-6-INFO: 195.149.233.1 send NOTIFICATION:
>> 3/11 (update: malformed ASPATH) with 21 byte data. mxReadMs=1555
>>
>> It does not look like previously mentioned attribute flag error. Does
>> anyone had something simillar ? It is a session with route server, so i
>> know about "no enforce first-as" option and it is turned on, it was
>> working fine till this night with no configuration change on our side.
>>
>> "show bgp malform update" looks like this:
>> May 29 10:52:15 Malformed UPDATE msg (nbr 195.149.233.1, context
>> 0x40080001, 77 bytes, repeated 5 times, reason: Invalid msg) -
>>    ffff ffff ffff ffff ffff ffff ffff ffff 004d 0200 0000 3240 0101 0040
>> 0212 0104 0000 17d9 0000 183e 0000 1840 0000 1967 4003 04c3 95e9 6480
>> 0404 0000 0000 c007 0800 0073 5fc3 95ef ff16 c395 ec
>>
>> SEOS version SEOS-12.1.1.11p7-Release
>>
>> Thanks in advance,
>> Best regards,
>>
>> -- 
>> Wojciech Wrona
>>
>> _______________________________________________
>> redback-nsp mailing list
>> redback-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/redback-nsp
>
>
>
> _______________________________________________
> redback-nsp mailing list
> redback-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/redback-nsp

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/redback-nsp/attachments/20180529/2c37e328/attachment.html>