bgp flapping every few minutes

[raspotine007]

Dear all, bgp flapping every few minutes..circuit is clear..ptt check many times no issue..here is the output from

sh ip bgp neigh 172.31.27.33

can you help me ?????? thank youuuu
BGP neighbor is 172.31.27.33, remote AS 21302, external link
BGP version 4, remote router ID x.x.x.x
BGP state = Established, up for 02:54:42
Last read 00:00:06, last write 00:00:04, hold time is 45, keepalive interval is 15 seconds
Configured hold time is 45, keepalive interval is 15 seconds
Minimum holdtime from neighbor is 0 seconds
Neighbor sessions:
1 active, is not multisession capable (disabled)
Neighbor capabilities:
Route refresh: advertised and received(new)
Four-octets ASN Capability: advertised and received
Address family IPv4 Unicast: advertised and received
Graceful Restart Capability: received
Remote Restart timer is 120 seconds
Address families advertised by peer:
none
Enhanced Refresh Capability: advertised
Multisession Capability:
Stateful switchover support enabled: NO for session 1
Message statistics:
InQ depth is 0
OutQ depth is 0

Sent Rcvd
Opens: 1 1
Notifications: 0 0
Updates: 9 94
Keepalives: 754 780
Route Refresh: 0 0
Total: 764 875
Do log neighbor state changes (via global configuration)
Default minimum time between advertisement runs is 30 seconds

For address family: IPv4 Unicast
Session: 172.31.27.33
BGP table version 697, neighbor version 697/0
Output queue size : 0
Index 1, Advertise bit 0
1 update-group member
Inbound soft reconfiguration allowed
Community attribute sent to this neighbor
Extended-community attribute sent to this neighbor
AF-dependant capabilities:
Outbound Route Filter (ORF) type (128) Prefix-list:
Receive-mode: received
Outgoing update network filter list is WAN_BGPV4_ACL_BLK_4222874083_172.31.27.33
Slow-peer detection is disabled
Slow-peer split-update-group dynamic is disabled
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 111 427 (Consumes 58072 bytes)
Prefixes Total: 111 451
Implicit Withdraw: 0 0
Explicit Withdraw: 0 24
Used as bestpath: n/a 427
Used as multipath: n/a 0
Used as secondary: n/a 0

Outbound Inbound
Local Policy Denied Prefixes: -------- -------
Bestpath from this peer: 451 n/a
Total: 451 0
Number of NLRIs in the update sent: max 61, min 0
Last detected as dynamic slow peer: never
Dynamic slow peer recovered: never
Refresh Epoch: 1
Last Sent Refresh Start-of-rib: never
Last Sent Refresh End-of-rib: never
Last Received Refresh Start-of-rib: never
Last Received Refresh End-of-rib: never
Sent Rcvd
Refresh activity: ---- ----
Refresh Start-of-RIB 0 0
Refresh End-of-RIB 0 0

Address tracking is enabled, the RIB does have a route to 172.31.27.33
Route to peer address reachability Up: 1; Down: 0
Last notification 02:54:49
Connections established 1; dropped 0
Last reset never
External BGP neighbor configured for connected checks (single-hop no-disable-connected-check)
Interface associated: GigabitEthernet4.2 (peering address in same link)
Transport(tcp) path-mtu-discovery is enabled
Graceful-Restart is disabled
SSO is disabled
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 1
Local host: 172.31.27.34, Local port: 46010
Foreign host: 172.31.27.33, Foreign port: 179
Connection tableid (VRF): 0
Maximum output segment queue size: 50

Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)

Event Timers (current time is 0xA2747B):
Timer Starts Wakeups Next
Retrans 758 0 0x0
TimeWait 0 0 0x0
AckHold 789 762 0x0
SendWnd 0 0 0x0
KeepAlive 0 0 0x0
GiveUp 0 0 0x0
PmtuAger 9852 9851 0xA274D2
DeadWait 0 0 0x0
Linger 0 0 0x0
ProcessQ 0 0 0x0

iss: 2148177541 snduna: 2148192850 sndnxt: 2148192850
irs: 583388447 rcvnxt: 583411692

sndwnd: 16384 scale: 0 maxrcvwnd: 16384
rcvwnd: 15168 scale: 0 delrcvwnd: 1216

SRTT: 1000 ms, RTTO: 1003 ms, RTV: 3 ms, KRTT: 0 ms
minRTT: 85 ms, maxRTT: 1000 ms, ACK hold: 200 ms
uptime: 10482556 ms, Sent idletime: 4169 ms, Receive idletime: 3985 ms
Status Flags: active open
Option Flags: nagle, path mtu capable
IP Precedence value : 6

Datagrams (max data segment is 1460 bytes):
Rcvd: 1539 (out of order: 0), with data: 789, total data bytes: 23244
Sent: 1538 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 758, total data bytes: 15308

Packets received in fast path: 0, fast processed: 0, slow path: 0
fast lock acquisition failures: 0, slow path: 0
TCP Semaphore 0x7FD085290DE0 FREE

[Philip D'Ath]

Can you post the log showing a couple of these flaps please.

[raspotine007]

Apr 21 10:59:05.734: %BGP-3-NOTIFICATION: received from neighbor 172.31.27.33 4/0 (hold time expired) 0 bytes

Apr 21 10:59:05.734: %BGP-5-NBR_RESET: Neighbor 172.31.27.33 reset (BGP Notification received)

Apr 21 10:59:05.736: %BGP-5-ADJCHANGE: neighbor 172.31.27.33 Down BGP Notification received

Apr 21 10:59:05.736: %BGP_SESSION-5-ADJCHANGE: neighbor 172.31.27.33 IPv4 Unicast topology base removed from session BGP Notification received

Apr 21 10:59:13.964: %BGP-5-ADJCHANGE: neighbor 172.31.27.33 Up

Apr 21 11:01:40.291: %BGP-3-NOTIFICATION: received from neighbor 2A02:948:4:1073::EEC1:X.X.X.X 4/0 (hold time expired) 0 bytes

Apr 21 11:01:40.291: %BGP-5-NBR_RESET: Neighbor 2A02:948:4:1073::EEC1:X.X.X.X reset (BGP Notification received)

Apr 21 11:01:40.291: %BGP-5-ADJCHANGE: neighbor 2A02:948:4:1073::EEC1:X.X.X.X Down BGP Notification received

Apr 21 11:01:40.292: %BGP_SESSION-5-ADJCHANGE: neighbor 2A02:948:4:1073::EEC1:X.X.X.X IPv6 Unicast topology base removed from session BGP Notification received

Apr 21 11:01:52.716: %BGP-5-ADJCHANGE: neighbor 2A02:948:4:1073::EEC1:X.X.X.X Up

Apr 21 11:03:34.287: %BGP-3-NOTIFICATION: sent to neighbor 172.31.27.33 4/0 (hold time expired) 0 bytes

Apr 21 11:03:34.288: %BGP-5-NBR_RESET: Neighbor 172.31.27.33 reset (BGP Notification sent)

Apr 21 11:03:34.291: %BGP-5-ADJCHANGE: neighbor 172.31.27.33 Down BGP Notification sent

Apr 21 11:03:34.291: %BGP_SESSION-5-ADJCHANGE: neighbor 172.31.27.33 IPv4 Unicast topology base removed from session BGP Notification sent

Apr 21 11:03:44.320: %BGP-5-ADJCHANGE: neighbor 172.31.27.33 Up

Apr 21 11:08:17.972: %BGP-3-NOTIFICATION: sent to neighbor 172.31.27.33 4/0 (hold time expired) 0 bytes

Apr 21 11:08:17.972: %BGP-5-NBR_RESET: Neighbor 172.31.27.33 reset (BGP Notification sent)

Apr 21 11:08:17.975: %BGP-5-ADJCHANGE: neighbor 172.31.27.33 Down BGP Notification sent

Apr 21 11:08:17.975: %BGP_SESSION-5-ADJCHANGE: neighbor 172.31.27.33 IPv4 Unicast topology base removed from session BGP Notification sent

Apr 21 11:08:24.941: %BGP-5-ADJCHANGE: neighbor 172.31.27.33 Up

[Philip D'Ath]

It looks like your nieghbour is not getting some of your packets.

Is the MTU correct on both sides of the link?

[raspotine007]

sh bgp ipv4 uni neighbors 172.31.27.33 | incl Datagrams
Datagrams (max data segment is 1460 bytes):

[Deepak Kumar]

Hi,

Please verify mtu and any packet loss.

[raspotine007]

sh inter gigabitEthernet 4 GigabitEthernet4 is up, line protocol is up   MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set Keepalive set (10 sec) Full Duplex, 1000Mbps, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:07:55, output 00:07:55, output hang never Last clearing of "show interface" counters never Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/40 (size/max) 5 minute input rate 608000 bits/sec, 178 packets/sec 5 minute output rate 644000 bits/sec, 194 packets/sec 10857549 packets input, 3896724968 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 11526838 packets output, 3571250205 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out

[Georg Pauwen]

Hello,

in addition to the other posts, looking at your output it shows that you are missing keepalives. The amount of sent and received keepalives should be equal:

Keepalives: 754 780

Try and enable 'bgp slow-peer detection'...

[raspotine007]

Can such flaps happens due to over utilization on the circuit? for example yesterday between the hours of 10 am and 4 pm GMT, we start seeing such behaviour..after 4pm GMT the link was stable!!!

[Georg Pauwen]

A fully utilized link could cause BGP traffic to experience problems indeed. Post the output of 'show interfaces x' from your interface and check if you see drops...

[paul driver]

Hello
If this is a direct or indirect connected peer you need to make sure l2/3 connection to it is established and not faulty which if it was would result in lost of the bgp connection  your are seeing, Your issue suggests you are losing NLRI towards 172.31.27.33.

Can you ping 172.31.27.33  source < your loopback>  ( i guess intermittently) 
Is it possible your filter lists negating this reachablity.
Check your cabling,physical connections..

BGP neighbor is 172.31.27.33, remote AS 21302, external link
Outgoing update network filter list is WAN_BGPV4_ACL_BLK_4222874083_172.31.27.33
Address tracking is enabled, the RIB does have a route to 172.31.27.33