<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Brandon,<div class=""><br class=""></div><div class="">This mess in 2011 was due to an empty AGGREGATOR attribute, interpreted as ASN 0, and ridiculously overzealous SEOS behaviour (the RFC was dumb and it was strictly implemented).<div class=""><a href="https://mailman.nanog.org/pipermail/nanog/2011-December/042524.html" class="">https://mailman.nanog.org/pipermail/nanog/2011-December/042524.html</a></div><div class=""><br class=""><div class="">It was fixed in SEOS 11.x. Last ones were 12.x.<br class=""><div>If you run some older XCRP3, you're in trouble.</div><div><br class=""></div><div>About your notification message, its decoding gives:</div><div><br class=""></div><div>0020 (length)</div><div>03 (message type: notification)</div><div>03 (error code: update message error)</div><div>04 (error subcode: Attribute Flags Error)</div><div>Attribute not recognised:</div><div>e0 (attribute flags: optional, transitive, partial [that is, not understood by a previous router on the path])</div><div>07 (attribute type code: AGGREGATOR)</div><div>08 (attribute length: 8, as expected for an AGGREGATOR with 32 bits ASN)</div><div>00 03 02 ed (aggregator AS: 197357, or AS "3:749" for SEOS)</div><div>Missing: the aggregator IP.</div><div><br class=""></div><div><br class=""></div><div>A matching prefix in the DFZ is 91.220.63.0/24, Aggregator [197357 91.220.63.1]. But there's nothing wrong with it.</div><div>From NTT the AS Path is: 2914 3223 197357 I</div><div><br class=""></div><div>There's no AS4_AGGREGATOR here, as it looks like your sessions is AS4 enabled (you can check the capabilities negotiated with sh bgp neighbor: CapSent / CapRcvd both containing 4byteAS, on SEOS). AS4_AGGREGATOR is used with non-AS4 routers.</div><div><br class=""></div><div><br class=""></div><div>Anyway, your option will probably be, as usual: update SEOS...</div><div><br class=""></div><div><br class=""></div><div>regards,</div><div>Olivier Benghozi</div><div><br class=""></div><div><br class=""></div><div><blockquote type="cite" class=""><div class="">Le 24 mars 2018 à 21:27, Brandon Leeberg <<a href="mailto:brandonl@localtel.net" class="">brandonl@localtel.net</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">send NOTIFICATION: 3/4 (update: attribute flags error) with 11 byte data. mxReadMs=5897<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">notification msg sent (nbr 129.250.203.101, context 0x40080002 32 bytes, repeated 167 times, code 3/4 (update: attribute flags error) -<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> 0000 0000 ffff ffff ffff ffff ffff ffff ffff ffff 0020 0303 04e0 0708 0003 02ed<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We have TONS of these, but only on the session with the one provider (NTT). NTT claims that it is due to 4-byte AS being enabled (I can’t find how to disable it). Our side hasn’t changed, but they did an update. They claim that out of hundreds of neighbors, we are the only ones having a problem.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">This was their response: “What looks like is happening is that when the attribute AS4_AGGREGATOR has a 4byte ASN it is not being properly handled by your device.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">While talking with our dev group about the pcap data and tracking down which update is the culprit one of our devs pointed out this thread which looks to match up:<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a href="https://mailman.nanog.org/pipermail/nanog/2011-December/042519.html" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">https://mailman.nanog.org/pipermail/nanog/2011-December/042519.html</a><span class="Apple-converted-space"> </span>“<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">both we the upstream provider have 2byte ASNs.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Any help would be greatly appreciated.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div></div></blockquote></div></div></div></div></body></html>