North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Strange BGP announcement.

  • From: alex
  • Date: Sun Nov 08 19:28:59 1998

core1.brd>sho ip bgp reg _0_

returns about 30 routes, like:

   Network          Next Hop          Metric LocPrf Weight Path
*d 204.255.24.0     207.106.96.5                         0 8001 8001 4969 1239 11606 0 0 i
*d 204.255.25.0     207.106.96.5                         0 8001 8001 4969 1239 11606 0 0 i


[[email protected] /]# whois -h rs.arin.net 11606
Warwick Online (ASN-WOL-AS)
   47 Main Street
   Warwick, New York 10990
   USA

   Autonomous System Name: WOL-AS
   Autonomous System Number: 11606


This is a independant telephone company in northern nj / sourthern NY
state.



core1.brd>sho ip bgp 204.255.24.0
BGP routing table entry for 204.255.24.0/24, version 4903495
Paths: (4 available, best #3, advertised over IBGP, EBGP)
  8001 8001 4969 1239 11606 0 0, (suppressed due to dampening)
    207.106.96.5 from 207.106.96.5
      Origin IGP, localpref 100, valid, external
      Community: 0:666 1:58376 4969:609 8001:666 8001:4969
      Dampinfo: penalty 7270, flapped 22 times in 00:38:24, reuse in 00:49:10
  6347 701 11606
    209.83.160.97 from 209.83.160.97 (209.83.159.2)
      Origin IGP, localpref 100, valid, external, best
      Community: 8001:666 8001:6347




On Sun, 8 Nov 1998, Craig A. Huegen wrote:

> A friend showed me several routes with path "1239 11606 0 0 i".
> 
> My guess is that these are causing problems too.
> 
> ---
> Connected to sl-warwick-1.sprintlink.net.
> Escape character is '^]'.
> 
> 
> Bay Networks, Inc. and its Licensors.
> Copyright 1992,1993,1994,1995,1996,1997,1998. All rights reserved.
> ---
> 
> It's a Bay -- I know that Bays will allow you to configure an AS prepend
> of "0" -- wonder if that's what's happening.
> 
> /cah
> 
> 
> On Sun, Nov 08, 1998 at 04:06:56PM -0500, Dave Curado wrote:
> ==>> Since this isn't directly my upstream's problem I've edited them out of the
> ==>> log (actually, this could have come from more than one of my upstreams)
> ==>> 
> ==>> Nov  8 17:45:26 BGP RECV x.x.x.x+179 -> x.x.x.x+1161
> ==>> Nov  8 17:45:26 BGP RECV message type 2 (Update) length 64
> ==>> Nov  8 17:45:26 BGP RECV flags 0x40 code Origin(1): Incomplete
> ==>> Nov  8 17:45:26 BGP RECV flags 0x40 code ASPath(2): (0x02 0x07 0x0f 0x7f 0x02 0xbd 0x0d 0xa5 0x03 0x30 0x03 0x2f 0x03 0x2e)
> ==>> Nov  8 17:45:26 BGP RECV flags 0x40 code NextHop(3): x.x.x.x
> ==>> Nov  8 17:45:26 BGP RECV flags 0xc0 code Aggregator(7): 6218 206.53.128.254
> ==>> Nov  8 17:45:26 BGP RECV        206.148.144/22
> ==>> Nov  8 17:45:26 
> ==>> Nov  8 17:45:26 bnp_path_attr_eer: peer x.x.x.x (External AS yyyy) bad update send NOTIFY flag 0 type 0  err_subcode 11, data 0
> ==>> Nov  8 17:45:26 NOTIFICATION sent to x.x.x.x (External AS yyyy): code 3 (Update Message Error) subcode 11 (AS path attribute problem) data
> ==>> Nov  8 17:45:26 
> ==>> Nov  8 17:45:26 BGP SEND x.x.x.x+1161 -> x.x.x.x+179
> ==>> Nov  8 17:45:26 BGP SEND message type 3 (Notification) length 21
> ==>> Nov  8 17:45:26 BGP SEND Notification code 3 (Update Message Error) subcode 11 (AS path attribute problem)
> ==>> Nov  8 17:45:26 
> ==>> 
> ==>> (We saw the problem start around 1640 GMT tonight)
> ==>> 
> ==>> Problem at AS6218 perhaps ? (of course if this is the result of some
> ==>> random corruption that can't be relied on... )
> ==>> 
> ==>> Anyone else see anything ? 
> ==>
> ==>Another note on this, I wasn't able to stop the updates
> ==>with a filter-list... perhaps because the AS path is 
> ==>problematic.  I had to use a distribute list instead, listing
> ==>each of the networks that 6218 is aggregating for...
> ==>Not sure if this affects anyone else or not, but:
> ==>
> ==>access-list 21 deny 206.53.128.0 0.0.3.255
> ==>access-list 21 deny 206.53.128.0 0.0.0.255
> ==>access-list 21 deny 206.53.129.0 0.0.0.255
> ==>access-list 21 deny 206.53.130.0 0.0.0.255
> ==>access-list 21 deny 206.53.131.0 0.0.0.255
> ==>access-list 21 deny 206.148.144.0 0.0.3.255
> ==>access-list 21 deny 206.190.224.0 0.0.0.255
> ==>access-list 21 permit any
> ==>
> ==>davec
> ==>
> 

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
     Atheism is a non-prophet organization. I route, therefore I am.
       Alex Rubenstein, [email protected], KC2BUO, ISP/C Charter Member
               Father of the Network and Head Bottle-Washer
     Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834
 Don't choose a spineless ISP; we have more backbone!  http://www.nac.net
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --