Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-24 Thread Heath Jones
Agreed. I haven't gone to the effort of double checking Brett's work - but the approach is definately the right one. It's very common for a developer to screw up a pointer or boolean operation, just sometimes these bugs actually make it past testing. I wouldn't be surprised.. Also, what's the

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-24 Thread Tima Maryin
Cogent probably hit CSCsy27511 I saw such thing when router affected by that bug sent malformed update to router that do not support 4 byte ASn. On 23.08.2010 2:49, randal k wrote: Cogent did an IOS upgrade to our local router, and immediately after our peering with them started flapping

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Gert Doering
Hi, On Sun, Aug 22, 2010 at 05:23:56PM -0600, randal k wrote: http://www.ciscosystems.com/en/US/docs/ios/12_0s/feature/guide/s_befasp.html no bgp enforce-first-as under your BGP config (or turning it on) I seem to remember a bug related to that. Not at the office or near a router to

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Zoe O'Connell
On 22/08/10 23:49, randal k wrote: Cogent did an IOS upgrade to our local router, and immediately after our peering with them started flapping wildly - gets about 10 seconds and ~69,000 prefixes in and resets with the following: 729078: Aug 22 16:21:39 MDT: %BGP-3-NOTIFICATION: sent to

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Florian Weimer
* Zoe O'Connell: 729078: Aug 22 16:21:39 MDT: %BGP-3-NOTIFICATION: sent to neighbor A.B.C.D 3/1 (update malformed) 21 bytes 31FE420C 31FE58C8 124683E8 0206CC67 00 729079: Aug 22 16:21:39 MDT: BGP: A.B.C.D Bad attributes 0060 0200 4140 0101 0040

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Zoe O'Connell
On 23/08/10 13:07, Florian Weimer wrote: * Zoe O'Connell: 729078: Aug 22 16:21:39 MDT: %BGP-3-NOTIFICATION: sent to neighbor A.B.C.D 3/1 (update malformed) 21 bytes 31FE420C 31FE58C8 124683E8 0206CC67 00 729079: Aug 22 16:21:39 MDT: BGP: A.B.C.D Bad attributes

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Brett Frankenberger
On Mon, Aug 23, 2010 at 01:34:50PM +0100, Zoe O'Connell wrote: On 23/08/10 13:07, Florian Weimer wrote: * Zoe O'Connell: 729078: Aug 22 16:21:39 MDT: %BGP-3-NOTIFICATION: sent to neighbor A.B.C.D 3/1 (update malformed) 21 bytes 31FE420C 31FE58C8 124683E8 0206CC67 00 729079: Aug 22

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread randal k
On Mon, Aug 23, 2010 at 6:34 AM, Zoe O'Connell zoe-...@complicity.co.ukwrote: On 23/08/10 13:07, Florian Weimer wrote: Yes, that's the conclusion we came to as well when we had it. (Luckily, it was an iBGP link to a firewall so easier to troubleshoot than a customer link). As far as I can

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Jared Mauch
On Aug 23, 2010, at 12:58 PM, randal k wrote: That said, our resolution was to get Cogent to downgrade so that we can keep buying their service. They are already chomping at the bit to re-upgrade though ... Speaking as another SP, we usually found that the customer had some *very old* code

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Drew Weaver
I think that there is some merit to the dont-capability-negotiate command, but I'm afraid that is going to take out all normal capabilities, like route refresh soft in/out, etc; this also appears to be semi-undocumented by Cisco, which makes that a little dicey to me. That said, our resolution

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread randal k
You know, I thought the same thing - because we're a small joint, we always point the finger at ourselves first. We always, double, triple check everything before we pick up the phone. But I also figure that such a gigantic organization -- or the guy typing in reload and looking at the results --

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-23 Thread Pete Lumbis
I'm with Brett here. The update is malformed and you are just the victim. I'd try to gather a packet capture as well and you should be able to go to your provider armed with the bogus BGP update in both pcap and log form and tell them it's their fault. -Pete On Mon, Aug 23, 2010 at 10:06 AM,

[c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-22 Thread randal k
Cogent did an IOS upgrade to our local router, and immediately after our peering with them started flapping wildly - gets about 10 seconds and ~69,000 prefixes in and resets with the following: 729078: Aug 22 16:21:39 MDT: %BGP-3-NOTIFICATION: sent to neighbor A.B.C.D 3/1 (update malformed) 21

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-22 Thread Charles Mills
Try: http://www.ciscosystems.com/en/US/docs/ios/12_0s/feature/guide/s_befasp.html no bgp enforce-first-as under your BGP config (or turning it on) I seem to remember a bug related to that. Not at the office or near a router to check exactly which it was but had a similar problem albeit with

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-22 Thread randal k
On Sun, Aug 22, 2010 at 5:03 PM, Charles Mills w3y...@gmail.com wrote: Try: http://www.ciscosystems.com/en/US/docs/ios/12_0s/feature/guide/s_befasp.html no bgp enforce-first-as under your BGP config (or turning it on) I seem to remember a bug related to that. Not at the office or near a

Re: [c-nsp] Cogent IOS upgrade == BGP-3, update malformed

2010-08-22 Thread Mikael Abrahamsson
On Sun, 22 Aug 2010, randal k wrote: They're on a 7609 running God-knows-what, we were on 12.4(13c) and upgraded to 12.4(24)T3, same issue. THat doesn't look like 7600 code, I guess it's some other platform? -- Mikael Abrahamssonemail: swm...@swm.pp.se