<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Same thing at TPIX. And it looks like it is the same route <b>16c395ec</b>
I've tried to decode whole BGP update message. It looks like this
(if i didn't make any mistake):<br>
<br>
<tt>ffff ffff ffff ffff ffff ffff ffff ffff </tt><tt><br>
</tt><tt><br>
</tt><tt>004d # Length 77 bytes</tt><tt><br>
</tt><tt>02 # BGP UPDATE</tt><tt><br>
</tt><tt><br>
</tt><tt>0000</tt><tt><br>
</tt><tt><br>
</tt><tt>0032 # path atributes length 50 bytes</tt><tt><br>
</tt><tt><br>
</tt><tt>4001 # Attribute type (ORIGIN)</tt><tt><br>
</tt><tt>01 # Attribute length 1 byte</tt><tt><br>
</tt><tt>00 # origin type IGP</tt><tt><br>
</tt><tt><br>
</tt><tt>4002 # Attribute type (AS-PATH)</tt><tt><br>
</tt><tt>12 # Attribute length 18 bytes</tt><tt><br>
</tt><tt>01 # AS_PATH Type</tt><tt><br>
</tt><tt>04 # AS_PATH Segment length: 4 ASes</tt><tt><br>
</tt><tt>0000 17d9 # AS6105</tt><tt><br>
</tt><tt>0000 183e # AS6206</tt><tt><br>
</tt><tt>0000 1840 # AS6208</tt><tt><br>
</tt><tt>0000 1967 # AS6503</tt><tt><br>
</tt><tt><br>
</tt><tt>4003 # Attribute type (NextHop)</tt><tt><br>
</tt><tt>04 # Attribute length 4 bytes</tt><tt><br>
</tt><tt>c395e964 # Next hop 195.149.233.100</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><tt>8004 # Attribute type (MULTI_EXIT_DISC)</tt><tt><br>
</tt><tt>04 # Attribute length 4 bytes</tt><tt><br>
</tt><tt>0000 0000 </tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><tt>c007 # Attribute type (AGGREGATOR)</tt><tt><br>
</tt><tt>08 # Attribute length 8 bytes</tt><tt><br>
</tt><tt>0000 735f c395 efff # Agregated by AS29535 IP:
195.149.239.255</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><tt>16 c3 95 ec # route 195.149.236.0/22</tt><br>
<br>
<br>
As-path looks ok to me, length of AS path is ok, only 2byte ASes
there i dont see any problem.... Take a look maybe You will notice
something.<br>
<br>
Best regards,<br>
<br>
<pre class="moz-signature" cols="72">--
Wojciech Wrona
</pre>
<div class="moz-cite-prefix">W dniu 29.05.2018 o 11:12, Olga
Savinovskaya pisze:<br>
</div>
<blockquote type="cite"
cite="mid:9d9b51cc-b4bb-49a8-00e6-9bb38a201aa2@jmdi.pl">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
We have the same problem from yesterday 23:15<br>
<br>
I created a ticket at the Atman(problem neighbor) but did not get
a response jet.<br>
<br>
<br>
May 29 10:41:01: [0266]: %BGP-6-INFO: 212.91.2.1 send
NOTIFICATION: 3/11 (update: malformed ASPATH) with 21 byte data.
mxReadMs=1073 <br>
<br>
May 29 10:41:01 notification msg sent (nbr 212.91.2.1, context
0x4008010a 42 bytes, repeated 192 times, code 3/11 (update:
malformed ASPATH) - <br>
0000 0000 ffff ffff ffff ffff ffff ffff ffff ffff 002a 0303 0b40
0212 0104 0000 17d9 0000 183e 0000 1840 <br>
<br>
May 29 10:41:01 Malformed UPDATE msg (nbr 212.91.2.1, context
0x4008010a, 92 bytes, repeated 192 times, reason: Invalid msg) - <br>
ffff ffff ffff ffff ffff ffff ffff ffff 005c 0200 0000 4140 0101
0040 0212 0104 0000 17d9 0000 183e 0000 1840 0000 1967 4003 04d4
5b00 1180 0404 0000 0000 c007 0800 <br>
0073 5fc3 95ef ffc0 080c 1b1b 0009 60ac 735f 735f 0a6b <b>16c3
95ec </b><br>
<br>
As i know 16c3 95ec = 22.195.149.236? But i can't parse from that
update what AS makes problem. <br>
<br>
SmartEdge OS Version SEOS-12.1.1.11p7-Release<br>
<br>
<pre class="moz-signature" cols="72">_________________
Pozdrawiam, Savinovskaya Olga</pre>
<br>
<blockquote type="cite"
cite="mid:70b31745-65b8-8e30-19ff-2b8588eae5fe@jmdi.pl">
<div class="moz-forward-container">
<pre>Hi everyone,
It looks like we've managed to find another strange problem with BGP on
SEOS. In the night one of our peers session started to flap with
following message:
May 29 10:52:01: [0001]: %BGP-6-INFO: 195.149.233.1 UP
May 29 10:52:15: [0001]: %BGP-6-INFO: 195.149.233.1 DOWN - Notification sent
May 29 10:52:15: [0001]: %BGP-6-INFO: 195.149.233.1 send NOTIFICATION:
3/11 (update: malformed ASPATH) with 21 byte data. mxReadMs=1555
It does not look like previously mentioned attribute flag error. Does
anyone had something simillar ? It is a session with route server, so i
know about "no enforce first-as" option and it is turned on, it was
working fine till this night with no configuration change on our side.
"show bgp malform update" looks like this:
May 29 10:52:15 Malformed UPDATE msg (nbr 195.149.233.1, context
0x40080001, 77 bytes, repeated 5 times, reason: Invalid msg) -
ffff ffff ffff ffff ffff ffff ffff ffff 004d 0200 0000 3240 0101 0040
0212 0104 0000 17d9 0000 183e 0000 1840 0000 1967 4003 04c3 95e9 6480
0404 0000 0000 c007 0800 0073 5fc3 95ef ff16 c395 ec
SEOS version SEOS-12.1.1.11p7-Release
Thanks in advance,
Best regards,
--
Wojciech Wrona
_______________________________________________
redback-nsp mailing list
<a class="moz-txt-link-abbreviated" href="mailto:redback-nsp@puck.nether.net" moz-do-not-send="true">redback-nsp@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/redback-nsp" moz-do-not-send="true">https://puck.nether.net/mailman/listinfo/redback-nsp</a>
</pre>
</div>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
redback-nsp mailing list
<a class="moz-txt-link-abbreviated" href="mailto:redback-nsp@puck.nether.net">redback-nsp@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/redback-nsp">https://puck.nether.net/mailman/listinfo/redback-nsp</a>
</pre>
</blockquote>
<br>
</body>
</html>