How to Check Whether EBGP Neighbor Flapping Is Caused by the Excessively Long AS-Path Attribute?

Adamcolob · Created May 4, 2017 08:53:16

There are three possible causes for neighbor flapping:

Improper processing during the forwarding of the route whose AS-Path attribute has more than 255 AS numbers to the EBGP neighbor
Sending of a error packet to Huawei device by a device of another vendor due to the failure to process the route with more than 255 AS numbers
Failure to parse the packet with more than 255 AS numbers by a device of another vendor although Huawei device can properly process the route
The corresponding checking methods are as follows:

Run the display bgp peerpeer-ip-addresslog-info command to check whether neighbor flapping is caused by 3/11 (3 indicates an Update packet error; 11 indicates an AS-Path attribute error in the Update packet).
Run the display bgp routing-table command to check whether the preferential routes with no less than 255 AS numbers are available for the neighbor. These routes will be forwarded to the neighbor.
The following examples describe the parsing of packets sent by Huawei device in scenarios (1) and (3).

Scenario 1: In an office, the logs on a device of another vendor that connects to Huawei device show that an error packet sent by Huawei device is received.

%BGP-5-ADJCHANGE: neighbor 219.150.48.128 Down BGP Notification sent Feb 17 00:25:22 CCT: %BGP-3-NOTIFICATION: sent to neighbor 219.150.48.128 3/11 (invalid or corrupt AS path) 518 bytes 50020202 020044E6 10260CB9 71B9BAFC BA3y39w: BGP: 219.150.48.128 Bad attributes FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 022C 0200 0002 1140 0101 00
50 02 //AS-Path attribute (length: two bytes)
02 02 //Total length
02 00 //Two segments (the first segment is a sequence containing 0 AS numbers, which is abnormal)
44 E610 260C B971 B9BA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FC40 0304 DB96 3080
15 //21-bit mask
5E 7DD8 // 94.125.216.0The AS-Path attribute with more than 255 AS numbers is not processed. Therefore, the AS number count field (one byte) is 0, and an error packet is generated. In this case, Huawei device is faulty.

Scenario 3: In an office, the EBGP neighbor between Huawei device and a device of another vendor flaps and then automatically recovers to the normal state. The logs on the device of another vendor show that the device receives the Update packet from Huawei device. The Update packet parsing result is as follows:

Feb 17 01:12:34.954 MNL: BGP: 120.28.27.1 Bad attributes FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 0245 0200 0002 2A40 0101 00
50 02 //AS-Path attribute (length: two bytes)
02 06 //Total length: 518
02 02 //Two segments (the first segment is a sequence containing two AS numbers)
24 58 //AS 9304
3C 34 //AS 15412
02 FF //The second segment is a sequence containing 255 AS numbers.
0B 6205 1371 B9BA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FCBA FC
40 0304 DABC 6895
4005 0400 0000 64
80 0904 781C 1B15
800A 0400 0000 02In this example, only the AS-Path attribute of the packet is analyzed.

The packet carries more than 255 AS numbers. The cause of neighbor disconnection is also that the AS-Path attribute of the route advertised by Huawei device to the device of another vendor carries more than 255 AS numbers. According to the protocol, each AS-Seq can store a maximum of 255 AS numbers. When the number of AS numbers exceeds 255, another AS-Seq should be used to store the additional AS numbers. However, the peer device of another vendor deems it as a fault (which is allowed by the protocol) and shuts down the neighbor. Thus, 5/0 BGP error occurs on Huawei device, which results in neighbor interruption. In this case, Huawei device is normal.

How to Check Whether EBGP Neighbor Flapping Is Caused by the Excessively Long AS-Path Attribute?

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

How to Check Whether EBGP Neighbor Flapping Is Caused by the Excessively Long AS-Path Attribute?

Third Party’s Trade Secret

My Followers