How to identify the BGP server and client while initiating TCP session

[gopikrish]

Hi All,

I am doing this in a testing environmet

I have configured BGP between two routers (in same AS).i have changed the router ID values in R1 & R2

But R1 is the only router which is starting the tcp session .

Can some one explain this ?

R1#debug ip packet det

R1#debug ip packet detail

IP packet debugging is on (detailed)

R1#clear ip bgp *

R1#

*Jun 1 08:48:13.143: %BGP-5-ADJCHANGE: neighbor 12.0.0.2 Down User reset

*Jun 1 08:48:13.143: IP: tableid=0, s=12.0.0.1 (local), d=12.0.0.2 (FastEtherne

t0/0), routed via FIB

*Jun 1 08:48:13.147: IP: s=12.0.0.1 (local), d=12.0.0.2 (FastEthernet0/0), len

40, sending

*Jun 1 08:48:13.151: TCP src=47349, dst=179, seq=2338240021, ack=3028194210

, win=16168 ACK PSH FIN

*Jun 1 08:48:13.179: IP: tableid=0, s=12.0.0.1 (local), d=12.0.0.2 (FastEtherne

t0/0), routed via FIB

*Jun 1 08:48:13.179: IP: s=12.0.0.1 (local), d=12.0.0.2 (FastEthernet0/0), len

44, sending

*Jun 1 08:48:13.183: TCP src=54932, dst=179, seq=3963613752, ack=0, win=163

84 SYN

*Jun 1 08:48:13.199: CEF: Try to CEF switch 12.0.0.1 from FastEthernet0/0

*Jun 1 08:48:13.199: CEF: Try to CEF switch 12.0.0.1 from FastEthernet0/0

*Jun 1 08:48:13.231: IP: tableid=0, s=12.0.0.2 (FastEthernet0/0), d=12.0.0.1 (F

astEthernet0/0), routed via RIB

*Jun 1 08:48:13.231: IP: s=12.0.0.2 (FastEthernet0/0), d=12.0.0.1 (FastEthernet

0/0), len 40, rcvd 3

*Jun 1 08:48:13.235: TCP src=179, dst=47349, seq=3028194210, ack=2338240022

, win=16168 ACK

*Jun 1 08:48:13.239: IP: tableid=0, s=12.0.0.2 (FastEthernet0/0), d=12.0.0.1 (F

astEthernet0/0), routed via RIB

*Jun 1 08:48:13.243: IP: s=12.0.0.2 (FastEthernet0/0), d=12.0.0.1 (FastEthernet

0/0), len 40, rcvd 3

*Jun 1 08:48:13.247: TCP src=179, dst=54932, seq=0, ack=3963613753, win=0 A

CK RST

*Jun 1 08:48:13.979: IP: tableid=0, s=12.0.0.1 (local), d=12.0.0.2 (FastEtherne

t0/0), routed via FIB

*Jun 1 08:48:13.979: IP: s=12.0.0.1 (local), d=12.0.0.2 (FastEthernet0/0), len

44, sending

*Jun 1 08:48:13.983: TCP src=18628, dst=179, seq=540096034, ack=0, win=1638

4 SYN

*Jun 1 08:48:14.083: CEF: Try to CEF switch 12.0.0.1 from FastEthernet0/0

*Jun 1 08:48:14.083: CEF: Try to CEF switch 12.0.0.1 from FastEthernet0/0

*Jun 1 08:48:14.087: IP: tableid=0, s=12.0.0.2 (FastEthernet0/0), d=12.0.0.1 (F

astEthernet0/0), routed via RIB

*Jun 1 08:48:14.091: IP: s=12.0.0.2 (FastEthernet0/0), d=12.0.0.1 (FastEthernet

0/0), len 40, rcvd 3

*Jun 1 08:48:14.095: TCP src=179, dst=47349, seq=3028194210, ack=2338240022

, win=16168 ACK PSH FIN

*Jun 1 08:48:14.099: IP: tableid=0, s=12.0.0.1 (local), d=12.0.0.2 (FastEtherne

t0/0), routed via FIB

*Jun 1 08:48:14.103: IP: s=12.0.0.1 (local), d=12.0.0.2 (FastEthernet0/0),

-------

Thanks

gopi

[bjornarsb]

Hi,

I would recomend a debug ip tcp transactions

instead!

Perform this on both routers and the output might give you a hint.

Reasons could be:

The neighbor statement is incorrect.

No routes to the neighbor address exist , or the default route (0.0.0.0/0) is being used to reach the peer.

The update-source command is missing under BGP.

HTH, if it does please check the scroll-box at the bottom right.

BR,

Bjornarsb

[mohammedmahmoud]

Hi,

To make sure which neighbor has initiated the BGP session, use the "sh ip bgp neighbor x.x.x.x", from the output you'll find these 2 lines:

Local host: y.y.y.y, Local port: 21388

Foreign host: x.x.x.x, Foreign port: 179

This means that the local router has initiated the TCP session using a random port to the remote neighbor on port 179 (179 as destination and random high port number as source - as if client and server).

Your output doesn't indicate any problems then there might not be a problem, as a rule Two routers should have only one BGP session between them, the "router-ID" value is exchanged when establishing BGP if two parallel sessions are detected only the session initiated by the router having the higher router ID will be retained, and the other will be dropped, i think that this is your case kindly check and feed us back.

HTH, please do rate all helpful replies,

Mohammed Mahmoud.

[eugene.fourie]

Hi gopikrish

Have you checked the messages from the other router when you initiate the #clear ip bgp *

If you executed the command from the other router, it would initiate the request and your messages source and destinations would be different.

Output example from R1 = 155.13.13.1

R1#clear ip bgp * soft

R1#

*Jun 1 13:04:24.559: CEF: Try to CEF switch 155.13.13.1 from Serial1/0

*Jun 1 13:04:24.559: IP: s=155.13.13.3 (Serial1/0), d=155.13.13.1 (Serial1/0), len 95, rcvd 3

*Jun 1 13:04:24.559: TCP src=179, dst=11001, seq=4274031073, ack=3767211758, win=16099 ACK PSH

*Jun 1 13:04:36.359: CEF: Try to CEF switch 155.13.13.1 from Serial1/0

*Jun 1 13:04:36.359: IP: s=155.13.13.3 (Serial1/0), d=155.13.13.1 (Serial1/0), len 59, rcvd 3

*Jun 1 13:04:36.359: TCP src=179, dst=11001, seq=4274031128, ack=3767211758, win=16099 ACK PSH

*Jun 1 13:04:36.623: CEF: Try to CEF switch 155.13.13.1 from Serial1/0

*Jun 1 13:04:36.623: IP: s=155.13.13.3 (Serial1/0), d=155.13.13.1 (Serial1/0), len 40, rcvd 3

*Jun 1 13:04:36.623: TCP src=179, dst=11001, seq=4274031147, ack=3767211777, win=16080 ACK

Output R3 = 155.13.13.3

R3#clear ip bgp * soft

R3#

*Jun 1 12:58:08.727: CEF: Try to CEF switch 155.13.13.3 from Serial1/0

*Jun 1 12:58:08.727: IP: s=155.13.13.1 (Serial1/0), d=155.13.13.3 (Serial1/0), len 40, rcvd 3

*Jun 1 12:58:08.727: TCP src=11001, dst=179, seq=3767211556, ack=4274030830, win=16278 ACK

R3#

*Jun 1 12:58:23.415: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up

R3#

*Jun 1 12:58:38.691: CEF: Try to CEF switch 155.13.13.3 from Serial1/0

*Jun 1 12:58:38.691: IP: s=155.13.13.1 (Serial1/0), d=155.13.13.3 (Serial1/0), len 59, rcvd 3

*Jun 1 12:58:38.691: TCP src=11001, dst=179, seq=3767211556, ack=4274030849, win=16259 ACK PSH

R3#

BGP is a TCP initiated and does not rely on Server and client, just TCP Transmissions, that is why when you execute the clear command the router that starts the process.

Please let me know if this helps.

Please rate posts

Thanks

[mohammedmahmoud · Accepted solution]

Hi,

Ok, let me put it in another phrase, any TCP session relies on a Client Server like ideology, were one end initiates the TCP session to the other end, in the case of BGP each router though of itself as a client and try to initiate a TCP session to the other router to port 179 as destination and random high port number as source.

The whole idea here is, it could happen that both routers has initiated TCP sessions to each other, and since two routers should have only one BGP session between them, and since the "router-ID" value is exchanged when establishing BGP, if two parallel sessions are detected only the session initiated by the router having the higher router ID will be retained, and the other will be dropped.

HTH, please do rate all helpful replies,

Mohammed Mahmoud.

[gopikrish]

HI All,

Thanks for your repy.

THANKS,

GOPI