<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">By manually decoding I can see it's AS Path 9002 3223 200651 (200651 being 3.4043 for a SmartEdge), prefix 185.100.84.0/23, with an aggregator attribute that seems fine, and two communities.<div class="">I don't see what is wrong, though, but it would be necessary to check every field and notably the lengths and so on.<br class=""><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">Le 30 janv. 2018 à 13:57, Marcin Kuczera <<a href="mailto:marcin@leon.pl" class="">marcin@leon.pl</a>> a écrit :</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div text="#000000" bgcolor="#FFFFFF" class="">
<div class="moz-cite-prefix">On 2018-01-30 13:23, Michał Przywuski
wrote:<br class="">
</div>
<blockquote type="cite" cite="mid:b0c667d7-9e1a-367a-2494-e14d9a5dba9f@jmdi.pl" class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><p class="">I found something like this :</p><p class="">[BGP]Dareek#sh bgp malform update<br class="">
</p>
Jan 30 02:34:31 Malformed UPDATE msg (nbr 87.245.245.128, context
0x4008010a, 77 bytes, repeated 14 times, reason: Invalid msg) - <br class="">
ffff ffff ffff ffff ffff ffff ffff ffff 004d 0200 0000 3240 0101
0040 020e 0203 0000 232a 0000 0c97 0003 0fcb 4003 0457 f5f5 80e0
0708 0003 0fcb 5d72 28a2 c008 0823 <br class="">
2a23 2a23 2afc 9117 b964 54<br class="">
</blockquote>
<br class="">
So, take RFC and try to analyse this.<br class="">
Or maybe somehow try to import it into wireshark..<br class="">
<br class="">
Marcin<br class="">
<br class="">
<br class="">
<blockquote type="cite" cite="mid:b0c667d7-9e1a-367a-2494-e14d9a5dba9f@jmdi.pl" class=""> <br class="">
<div class="moz-cite-prefix">W dniu 30.01.2018 o 13:06, Olivier
Benghozi pisze:<br class="">
</div>
<blockquote type="cite" cite="mid:45888B5E-7C56-49A3-BF29-BE161691BAB4@wifirst.fr" class="">
<meta http-equiv="Content-Type" content="text/html;
charset=utf-8" class="">
In 2011 the issue was with an AGGREGATOR attribute with AS 0.
<div class=""><br class="">
</div>
<div class="">So it's something else here.<br class="">
<div class="">Maybe like <a href="https://lists.gt.net/nsp/juniper/35537" class="" moz-do-not-send="true">https://lists.gt.net/nsp/juniper/35537</a> ?</div>
<div class=""><br class="">
</div>
<div class="">You'll have to capture the session and/or debug bgp on
the Smartedge to have some more information about the route
at problem, I guess.</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">Le 30 janv. 2018 à 12:54, Michał Przywuski
<<a href="mailto:mprzywuski@jmdi.pl" class="" moz-do-not-send="true">mprzywuski@jmdi.pl</a>> a
écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Hi , my device and log.<br class="">
<br class="">
[local]Dareek#sh ver<br class="">
<br class="">
Redback Networks SmartEdge OS Version
SEOS-12.1.1.11p7-Release<br class="">
Built by <a href="mailto:sysbuild@eussjlx7065.sj.us.am.ericsson.se" class="" moz-do-not-send="true">sysbuild@eussjlx7065.sj.us.am.ericsson.se</a>
Mon May 2 02:42:56 PDT 2016<br class="">
Copyright (C) 1998-2016, Redback Networks Inc. All
rights reserved.<br class="">
System Bootstrap version is Mips,rev2.0.2.69<br class="">
Installed minikernel version is 11.7<br class="">
Router Up Time - 40 days, 9 hours 21 minutes 33 secs<br class="">
<br class="">
<br class="">
Jan 30 02:25:54 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 send NOTIFICATION: 3/4 (update:
attribute flags error) with 11 byte data.
mxReadMs=3414<br class="">
Jan 30 02:26:43 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 UP<br class="">
Jan 30 02:27:20 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 DOWN - Notification sent<br class="">
Jan 30 02:27:20 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 send NOTIFICATION: 3/4 (update:
attribute flags error) with 11 byte data.
mxReadMs=2579<br class="">
Jan 30 02:28:18 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 UP<br class="">
Jan 30 02:28:49 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 DOWN - Notification sent<br class="">
Jan 30 02:28:49 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 send NOTIFICATION: 3/4 (update:
attribute flags error) with 11 byte data.
mxReadMs=2267<br class="">
Jan 30 02:29:40 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 UP<br class="">
Jan 30 02:30:21 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 DOWN - Notification sent<br class="">
Jan 30 02:30:21 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 send NOTIFICATION: 3/4 (update:
attribute flags error) with 11 byte data.
mxReadMs=4185<br class="">
Jan 30 02:31:08 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 UP<br class="">
Jan 30 02:31:48 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 DOWN - Notification sent<br class="">
Jan 30 02:31:48 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 send NOTIFICATION: 3/4 (update:
attribute flags error) with 11 byte data.
mxReadMs=2637<br class="">
Jan 30 02:32:36 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 UP<br class="">
Jan 30 02:33:06 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 DOWN - Notification sent<br class="">
Jan 30 02:33:06 10.15.1.1 [0266]: %BGP-6-INFO:
87.245.245.128 send NOTIFICATION: 3/4 (update:
attribute flags error) with 11 byte data.
mxReadMs=2709<br class="">
<br class="">
<br class="">
W dniu 30.01.2018 o 12:29, Olivier Benghozi pisze:<br class="">
<blockquote type="cite" class="">Update version. It
was some 6.x stuff, in 2011, so it's very old now.<br class="">
<br class="">
<blockquote type="cite" class="">Le 30 janv. 2018 à
12:17, Michał Przywuski <<a href="mailto:mprzywuski@jmdi.pl" class="" moz-do-not-send="true">mprzywuski@jmdi.pl</a>>
a écrit :<br class="">
<br class="">
Hi , i have a problem with BGP flapping , one of
peer send us notification and after that ower
session flap. I know some peapole also have
problem with that (<a href="https://mailman.nanog.org/pipermail/nanog/2011-December/042537.html" class="" moz-do-not-send="true">https://mailman.nanog.org/pipermail/nanog/2011-December/042537.html</a>).
Do you know how to fix it ?<br class="">
</blockquote>
</blockquote>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<br class="">
<fieldset class="mimeAttachmentHeader"></fieldset>
<br class="">
<pre wrap="" class="">_______________________________________________
redback-nsp mailing list
<a class="moz-txt-link-abbreviated" href="mailto:redback-nsp@puck.nether.net" moz-do-not-send="true">redback-nsp@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/redback-nsp" moz-do-not-send="true">https://puck.nether.net/mailman/listinfo/redback-nsp</a>
</pre>
</blockquote>
<br class="">
<pre class="moz-signature" cols="72">--
Michał Przywuski
Administrator sieci. </pre>
<br class="">
<fieldset class="mimeAttachmentHeader"></fieldset>
<br class="">
<pre wrap="" class="">_______________________________________________
redback-nsp mailing list
<a class="moz-txt-link-abbreviated" href="mailto:redback-nsp@puck.nether.net">redback-nsp@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/redback-nsp">https://puck.nether.net/mailman/listinfo/redback-nsp</a>
</pre>
</blockquote><p class=""><br class="">
</p>
<div class="moz-signature">-- <br class=""><p style="font-family: Helvetica, Arial, sans-serif; font-size:
12px; line-height: 14px; color: #999999;" class=""><span id="name-input" class="txt" style="font-weight: bold;">Marcin Kuczera</span> <span id="title-sep" class="">/</span> <span id="title-input" class="txt" style="color: #999;">Wiceprezes Zarządu / CTO<span class=""><br class="">
<span id="mobile-input" class="txt" style="color: #999;">+48
32 440 80 71<span id="email-sep" class="txt">/</span> <a id="email-input" class="link email" style="color:
#51930b;" href="mailto:marcin.kuczera@leon.pl">marcin.kuczera@leon.pl</a></span></span></span></p><p style="font-family: Helvetica, Arial, sans-serif; font-size:
12px; line-height: 14px;" class=""><span id="company-input" class="txt" style="font-weight: bold; color: #999;">Leon Sp. z o.o.</span>
<span id="office-sep" class="txt" style="color: #999;"> </span>
<span id="address-sep" class=""><br class="">
</span> <span id="address-input" class="txt" style="color:
#999;">ul. Kilińskiego 33d, 44-200 Rybnik </span><br class="">
<a id="website-input" class="link" style="color: #51930b;" href="http://www.leon.pl/">http://www.leon.pl/</a></p><p id="disclaimer-input" class="txt" style="font-family:
Helvetica, Arial, sans-serif; color: #999999; font-size: 12px;
line-height: 14px;">INTERNET | TELEWIZJA | TELEFON</p><p style="font-family: Helvetica, Arial, sans-serif; font-size:
12px; line-height: 14px;" class=""><span id="office-sep" class="txt" style="color: #999;">KRS 0000223101 Sąd Rejonowy w Gliwicach<br class="">
<span id="mobile-input" class="txt" style="color: #999;"></span><span id="mobile-input" class="txt" style="color: #999;"> Kapitał
zakładowy 576.700 zł<br class="">
<span id="mobile-input" class="txt" style="color: #999;"></span><span id="mobile-input" class="txt" style="color: #999;"> NIP:
6332068698</span></span></span></p>
</div>
</div>
_______________________________________________<br class="">redback-nsp mailing list<br class=""><a href="mailto:redback-nsp@puck.nether.net" class="">redback-nsp@puck.nether.net</a><br class="">https://puck.nether.net/mailman/listinfo/redback-nsp<br class=""></div></blockquote></div><br class=""></div></div></body></html>