Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

BGP Notification (Type3) Packet Decode

All,

I am having a real difficult time trying to capture a BGP notification packet. I can force a BGP notification using a basic ACL, and can see on the debug output that the notification is being sent, but I dont see a BGP type message. Could it be the notification message is just TCP with a RST bit set or something? But I would assume not as it would have to contain the BGP error code. Would anyone have a decode of this Type3 packet for me?

Output of debug:-

MSFC1>

6d11h: BGP: Applying map to find origin for 10.0.0.0/8

6d11h: BGP: 10.3.3.2 send message type 4, length (incl. header) 19

6d11h: BGP: Applying map to find origin for 10.0.0.0/8

6d11h: BGP: 10.3.3.2 send message type 4, length (incl. header) 19

6d11h: BGP: 10.3.3.2 rcv message type 4, length (excl. header) 0

6d11h: BGP: 10.3.3.2 rcv message type 4, length (excl. header) 0

6d11h: BGP: 10.3.3.2 rcv message type 3, length (excl. header) 2

6d11h: BGP: 10.3.3.2 received NOTIFICATION 4/0 (hold time expired) 0 bytes

6d11h: BGP: 10.3.3.2 went from Established to Closing

6d11h: BGP: 10.3.3.2 went from Closing to Idle

6d11h: BGP: 10.3.3.2 went from Closing to Idle

MSFC1>

1 REPLY
Bronze

Re: BGP Notification (Type3) Packet Decode

I guess the BGP notification will be sent only by one device and received by the other and then the connection gets closed. Since your debug output shows that this device is receiving notification, look at the debugs on the device which is sending this message to see if this is being displayed. I am not sure about the packet format but you can always use some freeware sniffing software and see the packet contents. You could try the one at http://www.ethereal.com

697
Views
0
Helpful
1
Replies
CreatePlease to create content