BGP flapping session

Chris Lane · ‎05-25-2010

We are an ISP and have many customer neighbor sessions on our router. One of my customers BGP sessions started flapping yesterday. The bridge we have to them has no errors or disconnects. So i debugged the bgp session and recieved the following. Also to note the customer router is a Juniper.

FYI: i removed the IPs.

ay 24 20:20:29.715: BGP: timer-wheel running slow by 1 ticks

May 24 20:20:35.780: BGP: remote close

May 24 20:20:35.780: BGP: -reset the session

May 24 20:20:35.780: BGP: rcv message type 3, length (excl. header) 2

May 24 20:20:35.780: BGPNSF state: went from nsf_not_active to nsf_not_active

May 24 20:20:35.780: BGP: went from Established to Idle

May 24 20:20:35.780: %BGP-5-ADJCHANGE: neighbor Down Peer closed the session

May 24 20:20:35.780: BGP: closing

May 24 20:20:35.780: BGP: read request no-op

May 24 20:20:39.530: BGP: read request no-op

May 24 20:21:01.676: BGP: read request no-op

May 24 20:21:10.878: BGP: went from Idle to Active

May 24 20:21:10.878: BGP: open active delayed 28655ms (35000ms max, 28% jitter)

May 24 20:21:13.831: BGP: passive open to 64.119.159.185

May 24 20:21:13.831: BGP: went from Active to Idle

May 24 20:21:13.839: BGP: went from Idle to Connect

May 24 20:21:13.839: BGP: read request no-op

May 24 20:21:13.839: BGP: rcv message type 1, length (excl. header) 36

May 24 20:21:13.839: BGP: rcv OPEN, version 4, holdtime 90 seconds

May 24 20:21:13.839: BGP: went from Connect to OpenSent

May 24 20:21:13.839: BGP: sending OPEN, version 4, my as: 19406, holdtime 180 seconds

May 24 20:21:13.839: BGP: rcv OPEN w/ OPTION parameter len: 26

May 24 20:21:13.839: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 6

May 24 20:21:13.839: BGP: OPEN has CAPABILITY code: 1, length 4

May 24 20:21:13.839: BGP: OPEN has MP_EXT CAP for afi/safi: 1/1

May 24 20:21:13.839: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 2

May 24 20:21:13.839: BGP: OPEN has CAPABILITY code: 128, length 0

May 24 20:21:13.848: BGP: OPEN has ROUTE-REFRESH capability(old) for all address-families

May 24 20:21:13.848: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 2

May 24 20:21:13.848: BGP: OPEN has CAPABILITY code: 2, length 0

May 24 20:21:13.848: BGP: OPEN has ROUTE-REFRESH capability(new) for all address-families

May 24 20:21:13.848: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 8

May 24 20:21:13.848: BGP: OPEN has CAPABILITY code: 64, length 6

BGP: rcvd OPEN w/ remote AS 46324

May 24 20:21:13.848: BGP: went from OpenSent to OpenConfirm

May 24 20:21:13.848: BGP: send message type 1, length (incl. header) 45

May 24 20:21:13.890: BGP: went from OpenConfirm to Established

May 24 20:21:13.890: %BGP-5-ADJCHANGE: neighbor Up

May 24 20:21:15.089: BGP_Router: unhandled major event code 128, minor 0

Any help would greatly be appreciated.

Chris

Mohamed Sobair · ‎05-25-2010

Hi Chris,

Just quick reference about BGP neihbor state and message types:

1- Idle

2- Active

3- Open sent

4- Open confirm

5- Established

Message Types are:

1- Open

2- Update

3- Notification

There is afourth message type but i dont remeber now,

Now , BGP peers negotiate capability options using Open message type, the capability option shows from the debug that both peers has the capability of Route refresh however , this shouldnt teer down the bgp session. I also see that neighbor has hard reset the bgp session which I believe could be done from the other . So, please check if the customer has reseted the BGP session manually from thier side.

HTH

Mohamed

francisco_1 · ‎05-25-2010

issue "show ip bgp summary" should give you some indication when the last flaps, state of the peering..

Francisco.

Giuseppe Larosa · ‎05-25-2010

Hello Chris,

the customer router is attempting to setup a multiprotocol BGP session

May 24 20:21:13.839: BGP: OPEN has MP_EXT CAP for afi/safi: 1/1

>> this should mean IPv4 unicast

ay 24 20:21:13.848: BGP: OPEN has ROUTE-REFRESH capability(new) for all address-families

the neighbor advertises that it supports route refresh capability as per RFC 2918

the session comes up but then the last message says an error has occurred:

May 24 20:21:13.890: %BGP-5-ADJCHANGE: neighbor Up

May 24 20:21:15.089: BGP_Router: unhandled major event code 128, minor 0

I would ask them if they did any config change or junos upgrade on their side

to be noted major event code 128 is not defined in standard BGP error codes

error code varies from 1 to 6 subcode depends on specific error code it can be 0 or non 0

see

http://www.tcpipguide.com/free/t_BGPErrorReportingNotificationMessages-3.htm

Hope to help

Giuseppe