The log message is rate limited, so not every received update will generate a log. If you send me one of the updates, I can tell you how it’s malformed. Regards, Jakob.
On May 23, 2025, at 04:29, Randy Bush <randy@psg.com> wrote:
You can use the CLI exec command
"show bgp update in error" to display the update and analyze it further.
RP/0/RSP0/CPU0:r2.dfw#show bgp update in error detail
VRF "default" Malformed Update messages: 19 Neighbors that received malformed Update messages: 2 Last malformed update received: May 20 07:02:30.421 (2d13h ago)
there was much more data in the log message
May 20 07:01:51 r2.f00 16869308: RP/0/RSP0/CPU0:May 20 07:01:51.437 : bgp[1059]: %ROUTING-BGP-3-MALFORM_UPDATE : Malformed UPDATE message received from neighbor 123.45.67.89 (VRF: default) - message length 106 bytes, error flags 0x000c0000, action taken "DiscardAttr". Error details: "Error 0x00040000, Field "Attr-length", Attribute 40 (Flags 0xe0, Length 28), Data [e0281c]". NLRIs: [IPv4 Unicast] 45.198.25.0/24
but the timestamps differ a bit
randy