05-25-2010 05:35 AM - edited 03-04-2019 08:35 AM
We are an ISP and have many customer neighbor sessions on our router. One of my customers BGP sessions started flapping yesterday. The bridge we have to them has no errors or disconnects. So i debugged the bgp session and recieved the following. Also to note the customer router is a Juniper.
FYI: i removed the IPs.
ay 24 20:20:29.715: BGP: timer-wheel running slow by 1 ticks
May 24 20:20:35.780: BGP: remote close
May 24 20:20:35.780: BGP: -reset the session
May 24 20:20:35.780: BGP: rcv message type 3, length (excl. header) 2
May 24 20:20:35.780: BGPNSF state: went from nsf_not_active to nsf_not_active
May 24 20:20:35.780: BGP: went from Established to Idle
May 24 20:20:35.780: %BGP-5-ADJCHANGE: neighbor Down Peer closed the session
May 24 20:20:35.780: BGP: closing
May 24 20:20:35.780: BGP: read request no-op
May 24 20:20:39.530: BGP: read request no-op
May 24 20:21:01.676: BGP: read request no-op
May 24 20:21:10.878: BGP: went from Idle to Active
May 24 20:21:10.878: BGP: open active delayed 28655ms (35000ms max, 28% jitter)
May 24 20:21:13.831: BGP: passive open to 64.119.159.185
May 24 20:21:13.831: BGP: went from Active to Idle
May 24 20:21:13.839: BGP: went from Idle to Connect
May 24 20:21:13.839: BGP: read request no-op
May 24 20:21:13.839: BGP: rcv message type 1, length (excl. header) 36
May 24 20:21:13.839: BGP: rcv OPEN, version 4, holdtime 90 seconds
May 24 20:21:13.839: BGP: went from Connect to OpenSent
May 24 20:21:13.839: BGP: sending OPEN, version 4, my as: 19406, holdtime 180 seconds
May 24 20:21:13.839: BGP: rcv OPEN w/ OPTION parameter len: 26
May 24 20:21:13.839: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 6
May 24 20:21:13.839: BGP: OPEN has CAPABILITY code: 1, length 4
May 24 20:21:13.839: BGP: OPEN has MP_EXT CAP for afi/safi: 1/1
May 24 20:21:13.839: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 2
May 24 20:21:13.839: BGP: OPEN has CAPABILITY code: 128, length 0
May 24 20:21:13.848: BGP: OPEN has ROUTE-REFRESH capability(old) for all address-families
May 24 20:21:13.848: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 2
May 24 20:21:13.848: BGP: OPEN has CAPABILITY code: 2, length 0
May 24 20:21:13.848: BGP: OPEN has ROUTE-REFRESH capability(new) for all address-families
May 24 20:21:13.848: BGP: rcvd OPEN w/ optional parameter type 2 (Capability) len 8
May 24 20:21:13.848: BGP: OPEN has CAPABILITY code: 64, length 6
BGP: rcvd OPEN w/ remote AS 46324
May 24 20:21:13.848: BGP: went from OpenSent to OpenConfirm
May 24 20:21:13.848: BGP: send message type 1, length (incl. header) 45
May 24 20:21:13.890: BGP: went from OpenConfirm to Established
May 24 20:21:13.890: %BGP-5-ADJCHANGE: neighbor Up
May 24 20:21:15.089: BGP_Router: unhandled major event code 128, minor 0
Any help would greatly be appreciated.
Chris
05-25-2010 06:13 AM
Hi Chris,
Just quick reference about BGP neihbor state and message types:
1- Idle
2- Active
3- Open sent
4- Open confirm
5- Established
Message Types are:
1- Open
2- Update
3- Notification
There is afourth message type but i dont remeber now,
Now , BGP peers negotiate capability options using Open message type, the capability option shows from the debug that both peers has the capability of Route refresh however , this shouldnt teer down the bgp session. I also see that neighbor has hard reset the bgp session which I believe could be done from the other . So, please check if the customer has reseted the BGP session manually from thier side.
HTH
Mohamed
05-25-2010 06:57 AM
issue "show ip bgp summary" should give you some indication when the last flaps, state of the peering..
Francisco.
05-25-2010 07:58 AM
Hello Chris,
the customer router is attempting to setup a multiprotocol BGP session
May 24 20:21:13.839: BGP: OPEN has MP_EXT CAP for afi/safi: 1/1
>> this should mean IPv4 unicast
ay 24 20:21:13.848: BGP: OPEN has ROUTE-REFRESH capability(new) for all address-families
the neighbor advertises that it supports route refresh capability as per RFC 2918
the session comes up but then the last message says an error has occurred:
May 24 20:21:13.890: %BGP-5-ADJCHANGE: neighbor Up
May 24 20:21:15.089: BGP_Router: unhandled major event code 128, minor 0
I would ask them if they did any config change or junos upgrade on their side
to be noted major event code 128 is not defined in standard BGP error codes
error code varies from 1 to 6 subcode depends on specific error code it can be 0 or non 0
see
http://www.tcpipguide.com/free/t_BGPErrorReportingNotificationMessages-3.htm
Hope to help
Giuseppe
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide