North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

SUMMARY: Strange BGP phantom announce remaining

  • From: Stephane Bortzmeyer
  • Date: Wed Nov 14 08:15:55 2001

First, the problem disappeared because Colt cleared the router which
was deceived by a bogus announce from Telecom Italia. Thanks.

On Mon, Nov 12, 2001 at 03:16:14PM +0100,
 Stephane Bortzmeyer <[email protected]> wrote 
 a message of 33 lines which said:

> I probably made a stupid mistake when changing my BGP announces but I

Apparently, I made no mistake. According to analysis done by Jim Cowie
with data at http://gradus.renesys.com, the change was properly
done. But at least one router in Telecom Italia did not receive it.

There was nothing we could do, since it took place at a far away
location. Without the action from Colt, we could have try to
re-announce the more specific route for ten minutes (let it
propagate), then to withdraw it again, hoping it will clear it. Next
time, I'll try :-)

> Does you have any idea why routers at Colt still see the old announce?

The question should have been "Why routers at Telecom Italia corrupted
Colt's database?". I received two hypothesis:

>From the Telia support (very helpful, like the Abovenet one):

>Cisco Bug Id CSCdt19638 :
>
>"BGP bestpath change not sent to peers
>
>Under rare circumstances, an updated Border Gateway Protocol (BGP)
>bestpath may not be propagated to the BGP peers of a router.
>
>Workaround: Enter the clear ip bgp * soft out EXEC command to update
>the peers with the current bestpath attributes."

[The workaround did not work in our case, since it was not *our*
router that send the wrong info.]

>From Neil J. McRae at Colt:

>We saw this route from a peer that was announcing us a huge number of
>routes that for some reason max-prefix didn't prevent from happening,
>although after rebooting, the box did take the session down. My guess
>is that the routes announced to us had sometype of corruption that
>didn't send it through the max-prefix subroutine properly to detect
>the number of routes being advertised.

Well, now it works, back to work.

> Configuration: Debian "woody", Linux kernel 2.4.9, Zebra routing
> software 0.91 and 0.92a (hence the copy to the Zebra

Nice software, no problem :-)