Re: BGP malformed update/attribute list

["Jakob Heitz (jheitz) via NANOG" <nanog () lists nanog org>]

The log message is rate limited, so not every received update will generate a log. If you send me one of the updates, I 
can tell you how it’s malformed.

Regards,
Jakob.

> On May 23, 2025, at 04:29, Randy Bush <randy () psg com> wrote:
>
> 
> > You can use the CLI exec command
> >
> > "show bgp update in error"
> > to display the update and analyze it further.
>
>    RP/0/RSP0/CPU0:r2.dfw#show bgp update in error detail
>
>    VRF "default"
>      Malformed Update messages: 19
>      Neighbors that received malformed Update messages: 2
>      Last malformed update received: May 20 07:02:30.421 (2d13h ago)
>
> there was much more data in the log message
>
> > > May 20 07:01:51 r2.f00 16869308: RP/0/RSP0/CPU0:May 20 07:01:51.437 : bgp[1059]: %ROUTING-BGP-3-MALFORM_UPDATE : 
> > > Malformed UPDATE message received from neighbor 123.45.67.89 (VRF: default) - message length 106 bytes, error flags 
> > > 0x000c0000, action taken "DiscardAttr". Error details: "Error 0x00040000, Field "Attr-length", Attribute 40 (Flags 
> > > 0xe0, Length 28), Data [e0281c]". NLRIs: [IPv4 Unicast] 45.198.25.0/24
>
> but the timestamps differ a bit
>
> randy
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/FFIITTZJYPMLL7QNSLBZO6I2F4A4C6OB/