%BGP-4-MSGDUMP: unsupported or mal-formatted message

[Mahesh Gohil]

Hello Experts,

One of my node is hit by below message:

Dec  8 01:03:00.765 UTC: %BGP-4-MSGDUMP: unsupported or mal-formatted message received from x.x.x.x:

FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 01A9 0200 0000 1A40 0101 0040 020C 0205
6575 2458 1D80 1026 00D1 4003 04CE DF73 3E14 C74F 6018 D121 2912 A74D 0018 4048
3F14 3F96 8018 D12A 0318 C6AF F318 482F BE18 C694 9C16 417F C017 3FF8 DE18 CC82
F817 86F4 AA18 4444 BD18 4444 BC18 CCE4 3C18 CCE4 1718 CC3E 8A18 86F4 BD17 1838
BC17 D054 1813 4126 8018 CC6A 1F17 4011 5818 C6BA B417 1834 2218 C699 8118 D054
1A18 8998 1617 1838 AA18 C7DF A118 CC6A 1C18 4444 BE13 42C6 C018 614B E917 C721
EA18 4444 BF16 1834 0414 4812 7018 614B EC18 614B ED18 480E 7418 480E 7018 480E

Dec  8 01:03:01.197 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor x.x.x.x IPv4 Unicast topology base removed from session  BGP Notification sent

What does it mean.?

It matches with one of bug:CSCsx73770 but not able to correctly understand the details provided in bug description. looks like written in french

Two questions:

1- How to decode above message marked in bold..is there any tool

2- Can anyone explains what is written in bug description.

My config do not include any ebgp-multihop command and there is one route-map for prepending who prepend my AS three times for some of the routes toward this peer.

any help will be well appreciated

Regards

Mahesh

[cadet alain]

Hi,

for bug description go here: http://blog.ioshints.info/2009/02/oversized-as-paths-cisco-ios-bug.html

[cadet alain]

Hi,

and for decoding:  http://ccie-in-3-months.blogspot.com/2010/08/decoding-ripe-experiment.html

[Mahesh Gohil]

Hello,

What I need is any tool if available which can interepret this message and not the pearl script.

I have already gone through bug info but criteria is not matching to the my config.

Regards

Mahesh

[cadet alain]

Hi,

for bug info the link I gave was for bug CSCsx73770 as you were guessing this might be this.

for tool maybe do a debug ip packet dump and then copy dump into text file as cap or pcap and then open it with a sniffer

Regards.