BGP TCP Session

[sivam siva]

Hi

Can anyone tell how to find which router first initiate the TCP session in BGP.

Thanks in Advance.

[Dennis Mink]

check this post:

https://learningnetwork.cisco.com/blogs/vip-perspectives/2017/12/14/demystifying-bgp-session-establishment

[omz · Accepted solution]

Good (should read) article already linked.. but unfortunately the author didn't mention about the connection collision. 

RFC 4271

If a pair of BGP speakers try to establish a BGP connection with each
other simultaneously, then two parallel connections well be formed.
If the source IP address used by one of these connections is the same
as the destination IP address used by the other, and the destination
IP address used by the first connection is the same as the source IP
address used by the other, connection collision has occurred.  In the
event of connection collision, one of the connections MUST be closed.

Based on the value of the BGP Identifier, a convention is established
for detecting which BGP connection is to be preserved when a
collision occurs.  The convention is to compare the BGP Identifiers
of the peers involved in the collision and to retain only the
connection initiated by the BGP speaker with the higher-valued BGP
Identifier.

[Dennis Mink]

thanks for point that out +5

[sivam siva]

Thank you @omc 79

[omz]

@sivam siva You welcome!

[paul driver]

Hello

Just like to add.... The simplistic way is to check the local/foreign tcp port of the peering. (port 179 is the initiated side)

sh ip bgp neighbors xxx | in port

[omz]

@paul driver hmm I am a bit confused by 'port 179 is the initiated side'

Would the initiated side not have a random source port with destination port 179?

Thinking about TCP, would server not be listening on 179?

Am I missing something?

[paul driver]

Hello

Not a problem , You are indeed correct 179 is the server port- my first statement the wrong away around, foreign port is the initiated port.

However my understanding of bgp is that it is some different how it handles the peering, You are correct in saying the initiated rtr (client) will at first source from a random port to dest tcp 179  however in the returning syn acks the client/server roles can be swapped around so the replying rtr could become the client, So when finally the peering is established it can be the rtr that first initiated the session that has ended up with the local tcp179 port and its peer that has the foreign port as a random number.

[omz]

Apologies to be a pain.. I do not understand the swap.

R3#sh tcp bri | b TCB
TCB       Local Address               Foreign Address             (state)
F28B8F90  3.3.3.3.60425              4.4.4.4.179                 ESTAB
R3#sh ip bgp nei 4.4.4.4 | i _port
Local host: 3.3.3.3, Local port: 60425
Foreign host: 4.4.4.4, Foreign port: 179
R3#

[paul driver]

Hello

Apply a debug  ( ip packet detail ) Then create a bgp session from scratch and watch the trace as the session is established you should eventually see the rtr which becomes the initiated speaker.

Now going back to the OP, checking the bgp neighboring local/foreign ports will show you the bgp initiator