BGP flapping session

Unanswered Question
May 25th, 2010
User Badges:

We are an ISP and have many customer neighbor sessions on our router. One of my customers BGP sessions started flapping yesterday. The bridge we have to them has no errors or disconnects. So i debugged the bgp session and recieved the following. Also to note the customer router is a Juniper.

FYI: i removed the IPs.


ay 24 20:20:29.715: BGP: timer-wheel running slow by 1 ticks

May 24 20:20:35.780: BGP:  remote close

May 24 20:20:35.780: BGP:  -reset the session

May 24 20:20:35.780: BGP:  rcv message type 3, length (excl. header) 2

May 24 20:20:35.780: BGPNSF state:  went from nsf_not_active to nsf_not_active

May 24 20:20:35.780: BGP:  went from Established to Idle

May 24 20:20:35.780: %BGP-5-ADJCHANGE: neighbor  Down Peer closed the session

May 24 20:20:35.780: BGP:  closing

May 24 20:20:35.780: BGP:  read request no-op

May 24 20:20:39.530: BGP:  read request no-op

May 24 20:21:01.676: BGP:  read request no-op

May 24 20:21:10.878: BGP:  went from Idle to Active

May 24 20:21:10.878: BGP:  open active delayed 28655ms (35000ms max, 28% jitter)

May 24 20:21:13.831: BGP:  passive open to 64.119.159.185

May 24 20:21:13.831: BGP:  went from Active to Idle

May 24 20:21:13.839: BGP:  went from Idle to Connect

May 24 20:21:13.839: BGP:  read request no-op

May 24 20:21:13.839: BGP:  rcv message type 1, length (excl. header) 36

May 24 20:21:13.839: BGP:  rcv OPEN, version 4, holdtime 90 seconds

May 24 20:21:13.839: BGP:  went from Connect to OpenSent

May 24 20:21:13.839: BGP:  sending OPEN, version 4, my as: 19406, holdtime 180 seconds

May 24 20:21:13.839: BGP:  rcv OPEN w/ OPTION parameter len: 26

May 24 20:21:13.839: BGP:  rcvd OPEN w/ optional parameter type 2 (Capability) len 6

May 24 20:21:13.839: BGP:  OPEN has CAPABILITY code: 1, length 4

May 24 20:21:13.839: BGP:  OPEN has MP_EXT CAP for afi/safi: 1/1

May 24 20:21:13.839: BGP:  rcvd OPEN w/ optional parameter type 2 (Capability) len 2

May 24 20:21:13.839: BGP:  OPEN has CAPABILITY code: 128, length 0

May 24 20:21:13.848: BGP:  OPEN has ROUTE-REFRESH capability(old) for all address-families

May 24 20:21:13.848: BGP:  rcvd OPEN w/ optional parameter type 2 (Capability) len 2

May 24 20:21:13.848: BGP:  OPEN has CAPABILITY code: 2, length 0

May 24 20:21:13.848: BGP:  OPEN has ROUTE-REFRESH capability(new) for all address-families

May 24 20:21:13.848: BGP:  rcvd OPEN w/ optional parameter type 2 (Capability) len 8

May 24 20:21:13.848: BGP:  OPEN has CAPABILITY code: 64, length 6

BGP:  rcvd OPEN w/ remote AS 46324

May 24 20:21:13.848: BGP:  went from OpenSent to OpenConfirm

May 24 20:21:13.848: BGP:  send message type 1, length (incl. header) 45

May 24 20:21:13.890: BGP:  went from OpenConfirm to Established

May 24 20:21:13.890: %BGP-5-ADJCHANGE: neighbor  Up

May 24 20:21:15.089: BGP_Router: unhandled major event code 128, minor 0


Any help would greatly be appreciated.

Chris

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Mohamed Sobair Tue, 05/25/2010 - 06:13
User Badges:
  • Gold, 750 points or more

Hi Chris,



Just quick reference about BGP neihbor state and message types:


1- Idle

2- Active

3- Open sent

4- Open confirm

5- Established


Message Types are:


1- Open

2- Update

3- Notification


There is afourth message type but i dont remeber now,


Now , BGP peers negotiate capability options using Open message type, the capability option shows from the debug that both peers has the capability of Route refresh however , this shouldnt teer down the bgp session. I also see that neighbor has hard reset the bgp session which I believe could be done from the other . So, please check if the customer has reseted the BGP session manually from thier side.




HTH

Mohamed

francisco_1 Tue, 05/25/2010 - 06:57
User Badges:
  • Gold, 750 points or more

issue "show ip bgp summary" should give you some indication when the last flaps, state of the peering..


Francisco. 

Giuseppe Larosa Tue, 05/25/2010 - 07:58
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Chris,

the customer router is attempting to setup a multiprotocol BGP session


May 24 20:21:13.839: BGP:  OPEN has MP_EXT CAP for afi/safi: 1/1 

>> this should mean IPv4 unicast


ay 24 20:21:13.848: BGP:  OPEN has ROUTE-REFRESH capability(new) for all address-families


the neighbor advertises that it supports route refresh capability as per RFC 2918


the session comes up but then the last message says an error has occurred:



May 24 20:21:13.890: %BGP-5-ADJCHANGE: neighbor  Up

May 24 20:21:15.089: BGP_Router: unhandled major event code 128, minor 0



I would ask them if they did any config change or junos upgrade on their side


to be noted major event code 128 is not defined in standard BGP error codes


error code varies from 1 to 6 subcode depends on specific error code it can be 0 or non 0


see

http://www.tcpipguide.com/free/t_BGPErrorReportingNotificationMessages-3.htm


Hope to help

Giuseppe

Actions

This Discussion