<br /><blockquote><div dir="ltr"><div><div><div>Hi. Some issue is detected with SeOS version SEOS-12.1.1.12p13-Release<br /></div><div>The issue is about BGP protocol handling. <br /></div><div>The problem is, that SeOS close a BGP session on receiving mailformed UPDATE message from a peer. The peer is Juniper. <br /></div><div><br />On the peer side:<br /><p><font size="4"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125);" lang="EN-US">bgp_read_v4_message:11175:
NOTIFICATION received from 5.143.236.222 (External AS 48711): code 3
(Update Message Error) subcode 4 (attribute flags error), Data: e0
<span><span>07 08 00 03 02</span></span> Apr 30 09:52:06 2018</span></font></p></div><div><br /><b>On SeOS side:</b><br /><br />bgp neighbor 5.143.236.221<br />BGP neighbor: 5.143.236.221, remote AS: 12389, external link<br /> Version: 4, router identifier: 178.34.128.3<br /> State: Idle for 00:00:25<br /> Last read 00:00:25, last send 00:00:25<br /> Hold time: configured 180, negotiated 0<br /> Keepalive time: configured 30, negotiated 0<br /> Local restart timer 120 sec, stale route retain timer 180 sec<br /> Received restart timer 0 sec, flag 0x0<br /> Number of hops external BGP neighbor may be away: 1<br /> Minimum time between advertisement runs: 30 secs<br /> Source (local) IP address: 0.0.0.0<br /> Received messages: 0 (0 bytes), notifications: 0, in queue: 0<br /> Sent messages: 0 (0 bytes), notifications: 289, out queue: 0<br /> Last active open: 06:10:23, reason: Have not registered with RIB<br /> Reset count: 289, last reset time: 00:00:25, reset reason: N<b>otification sent (update: attribute flags error)</b><br /><br />show bgp neighbor 5.143.236.221 malform update <br />Apr 30 10:42:23
Malformed UPDATE msg (nbr 5.143.236.221, context 0x<span><span>40080002</span></span>, 80 bytes,
repeated 1512 times, reason: Invalid msg) - <br />ffff ffff ffff ffff ffff
ffff ffff ffff <span><span>0050 0200 0000 3540 0101 0040 020</span></span>e <span><span>0203 0000 3065 0000</span></span>
0c<span><span>97 0003 02</span></span>ed <span><span>4003 0405 8</span></span>fec dd40 0600 e<span><span>007 0800 0302</span></span> ed5b dc3f 01c0
<span><span>0808 3065 0006 3065 0007 185</span></span>b dc3f<br /></div><br /></div>Lets parse this data.<br />ffff ffff ffff ffff ffff ffff ffff ffff - the init marker<br /></div>0050 - totak message length - 80 bytes<br /><div><br /><b>02</b> - UPDATE <br /><div><b>0000</b> Length of Withdrawn Routes <br /><b>0035</b> Total size of attributes (<b>53 bytes</b>)<br /></div><div><br /></div><div>Attributes:<br /></div><div><b><span><span>40 01 01 00</span></span></b><br />ORIGIN (IGP) <br /></div><div><br /></div><div><b>40 02 0e <span><span>02 03 0000 3065 0000 0</span></span>c<span><span>97 0003 02</span></span>ed</b><br /></div><div>40-flags<br /></div><div>02 - AS_PATH<br /></div><div>0e - length - 14 <b>bytes<br /></b></div><div>02 - segment type AS_SEQUENCE <br />03 - 3 AS length<br /><span><span>0000 3065 0000 0</span></span>c<span><span>97 0003 02</span></span>ed - ASN itself (12389,3223,197357)<br /></div><div><br /><b><span><span>40 03 04 05 8</span></span>f ec dd<br /></b>NEXT_HOP<b> </b>5.143.236.221<b><br /></b></div><div><b><br /></b></div><div><b>40 06 00 <br /></b>an empty ATOMIC_AGGREGATE attribute<br /></div><div><br /><b>e<span><span>0 07 08 0003 02</span></span>ed 5b dc 3f 01 </b><br />AGGREGATOR AS 197357 IP 93.220.63.1<br /></div><div><br /></div><div><b>c<span><span>0 08 08 3065 0006 3065 0007</span></span> <br /></b></div><div>COMMUNITY 12389:6 12389:7<b><br /></b></div><div></div><div><br /><b>18 5b dc 3f <br /></b></div>Prefixes<b> </b><a href="http://91.220.63.0/24" target="_blank">91.220.63.0/24</a><b><br /></b><br /></div><div>According the notification message SeOS threats the AGGREGATOR attribute flags as mailfomed:<br /><b>e<span><span>0 07 08 0003 02</span></span>ed 5b dc 3f 01 </b></div><div>I don't see anything wrong with it. <br />IMHO the AGGRETATOR attribute is composed with all RFC requirements<br /></div><div><br />Can somebody explain me such unexpected behavior?<br /></div><div><br /></div></div></blockquote>