Community discussions

MikroTik App
  4. RouterOS
  5. General

BGP Malformed AS_PATH

Post Reply
 
User avatar
NetTraptor
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 76
Joined: Tue May 17, 2005 4:12 pm
Location: Athens Greece
Contact:
Contact NetTraptor

BGP Malformed AS_PATH

Sat Nov 24, 2007 1:27 am

We have an issue here with updates that we are getting from peers.

The log shows Malformed AS_PATH but whatever that means?

As soon as we get a route update with such a malformed AS_PATH, all peers reset.

We googled it a bit but i don't know how relevant are the references.. :(

In what case is this message produced?
How can we filter those route updates out if we can not avoid them?
Why does 2.9.44 work ok and why 2.9.45 onwards up to 3.0rc10 have this behavior?
:?
Can we have some help on this. The debug logs are not very enlightening.
Top
 
User avatar
NetTraptor
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 76
Joined: Tue May 17, 2005 4:12 pm
Location: Athens Greece
Contact:
Contact NetTraptor

Re: BGP Malformed AS_PATH

Sun Nov 25, 2007 2:02 pm

No reply? :shock:
Top
 
mnezor
just joined
Posts: 8
Joined: Sat Jun 17, 2006 10:17 pm

Re: BGP Malformed AS_PATH

Sun Nov 25, 2007 11:30 pm

....same problem here ... with all routerboards with RC10 .. routers with 2.9.49 survive and not reset their peers...

Shouldnt the option '' Ignore AS path length'' to be able to resolve this issue?

Please help us or ... for God's shake port to Routeros QUAGGA for bgp routing.
Top
 
User avatar
NetTraptor
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 76
Joined: Tue May 17, 2005 4:12 pm
Location: Athens Greece
Contact:
Contact NetTraptor

Re: BGP Malformed AS_PATH

Mon Nov 26, 2007 5:57 pm

Code: Select all
route,bgp,debug,packet UPDATE Message in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet     MessageLength=61 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw Received UPDATE packet in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     Length=61 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     00 3D 02 00 00 00 22 40 01 01 00 40 02 14 02 09 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     30 07 22 9F 13 18 24 48 0E 51 09 0B 09 4B 03 91 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     08 D3 40 03 04 0A 48 9B FE 18 0A 02 1A in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet  in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet     PathAttributes in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet         nexthop=*40186050 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet         bgp-origin=IGP in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet         bgp-aspath=12295,8863,4888,9288,3665,2315,2379,913,2259 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet         bgp-aspath-len=9 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet         bgp-nexthop=10.72.155.254 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet  in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet     NLRI=10.2.26.0/24 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug Add/Update/Remove route by key in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug     Key128: in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug         00 00 00 00 0A 48 9B 01 0A 02 1A 00 FF FF FF 00 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug     Route/Update=DT20 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet UPDATE Message in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet     MessageLength=61 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw Received UPDATE packet in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     Length=61 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     00 3D 02 00 00 00 22 40 01 01 00 40 02 14 02 09 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     30 07 22 9F 13 18 24 48 0E 51 09 0B 09 4B 03 91 in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet,read,raw     10 F6 40 03 04 0A 48 9B FE 18 0A 02 2D in 26-Nov 17:47:12.88 from 10.40.125.65
route,bgp,debug,packet  in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet     PathAttributes in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet         nexthop=*40186050 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet         bgp-origin=IGP in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet         bgp-aspath=12295,8863,4888,9288,3665,2315,2379,913,4342 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet         bgp-aspath-len=9 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet         bgp-nexthop=10.72.155.254 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet  in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet     NLRI=10.2.45.0/24 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug Add/Update/Remove route by key in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug     Key128: in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug         00 00 00 00 0A 48 9B 01 0A 02 2D 00 FF FF FF 00 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug     Route/Update=DT20 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet UPDATE Message in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet     MessageLength=69 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw Received UPDATE packet in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     Length=69 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     00 45 02 00 00 00 2A 40 01 01 00 40 02 1C 02 0B in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     30 07 22 9F 13 18 24 48 0E 51 09 0B 09 4B 03 91 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     10 F6 25 F2 0C 3C 03 01 1B A9 40 03 04 0A 48 9B in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     FE 18 0A 56 5C in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet Invalid AS_PATH attribute in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,error UPDATE message error:  Malformed AS_PATH in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,state Entering Idle state in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,state     RemoteAddr=10.72.155.254 in 26-Nov 17:47:12.90 from 10.40.125.65
Does this Help at all..?
On the other hand do not over estimate Quagga. Some of those Malformed AS_Paths might be due to quagga...although i should say i agree with you :)
The point is how can we prevent this sort of DoS happening?

Anyone there???
Top
 
changeip
Forum Guru
Forum Guru
Posts: 3833
Joined: Fri May 28, 2004 5:22 pm

Re: BGP Malformed AS_PATH

Mon Nov 26, 2007 8:35 pm

Can you get a pcap of that update command and review it with wireshark? Once decoded I bet we can figure out what it's choking on.
Code: Select all
route,bgp,debug,packet,read,raw     FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     00 45 02 00 00 00 2A 40 01 01 00 40 02 1C 02 0B in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     30 07 22 9F 13 18 24 48 0E 51 09 0B 09 4B 03 91 in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     10 F6 25 F2 0C 3C 03 01 1B A9 40 03 04 0A 48 9B in 26-Nov 17:47:12.90 from 10.40.125.65
route,bgp,debug,packet,read,raw     FE 18 0A 56 5C in 26-Nov 17:47:12.90 from 10.40.125.65
I see that packet is 69 in length and the others are 61. Without decoding it though it's hard to tell whats in that UPDATE that it doesn't like.
Top
 
smytht
Trainer
Trainer
Posts: 87
Joined: Wed Jun 06, 2007 6:35 pm
Location: Tipperary / Dublin & Ireland
Contact:
Contact smytht

Re: BGP Malformed AS_PATH

Tue Feb 18, 2014 1:21 am

... Check your Route Filters... Ensure that your AS Prepend is not set to 0

AS prepend should be Greater than or equal to 1

...your AS needs to be prepended at least once on any adverisements to your neighbour in most ISP e-BGP Configurations
Top
Post Reply
  4. RouterOS
  5. General