At the risk of "me too" noise, we felt this as well, but only on exabgp 4.2.21. -Michael
-----Original Message----- From: John Stitt via NANOG <nanog@lists.nanog.org> Sent: Tuesday, May 20, 2025 8:49 AM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: John Stitt <jstitt@hop-electric.com> Subject: Re: BGP malformed update/attribute list
For what it's worth, while we didn't see sessions reset, I do recall that we have bgp-error-tolerance enabled on our Juniper routers, so it's possible that kept our sessions from resetting.
Customer that saw sessions drop is running Arista.
John Stitt
________________________________ From: Ryan Rawdon via NANOG <nanog@lists.nanog.org> Sent: Tuesday, May 20, 2025 8:46 AM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: Ryan Rawdon <ryan@u13.net> Subject: Re: BGP malformed update/attribute list
On 2025-05-20 09:31, Simon Lockhart via NANOG wrote:
Did anyone see BGP flaps this morning at about 07:01 UTC as a result of BGP malformed update?
I was just mentioning this with you on IRC, here's the details of what we saw. We were most-impacted in Virginia at our two locations there, 11 of 12 transit IPv4 sessions (3 uptream ASNs) failed. IPv6 was unaffected.
First instance at May 20 07:01:51
Last instance of that message in our logs was at May 20 07:08:08
Other regions across our global locations saw it, but only one or two sessions/upstreams here and there.
It flapped one of our iBGP sessions:
May 20 08:01:51.150 BST: %BGP-3-NOTIFICATION: received from
neighbor
XXX.XXX.XXX.XXX 3/1 (update malformed) 31 bytes E0281C00 00000000 00000000 00000000 00
Another ISP saw the same thing...
code 3 (Update Message Error) subcode 1 (invalid attribute list), Data: e0 28 1c 00 00 00
Is there a new BGP rogue update out there?
Simon _______________________________________________ NANOG mailing list
https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.co m/?url=https*3A*2F*2Flists.nanog.org*2Farchives*2Flist*2Fnanog*40lists.n anog.org*2Fmessage*2FGQP6V6BONTN2BPD7XSGW27WLZE5F3L7K*2F&da ta=05*7C02*7Cjstitt*40hop- electric.com*7C3686ee1866d749ada05408dd97a4cbfe*7C7707c291b2534 ee2bcd6557cdf0fea43*7C0*7C0*7C638833456248584078*7CUnknown*7 CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOi JXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ*3D*3D*7C0*7C*7C*7C&sdata=qUlr 65OWUt6HXJYNgHCbWIIH*2B4*2By8ciuKSfrFRmsz6k*3D&reserved=0__;JSU lJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!Mak6IKo!OPoGhsi5tewNN6GfzW0- L8VOBop52gZU09qxZ0ZVlZTFmiPy02- vv72_UlLMEuOp2dZpGPtrf3SnHUCJSddn$ <https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@li sts.nanog.org/message/GQP6V6BONTN2BPD7XSGW27WLZE5F3L7K/__;!!M ak6IKo!OPoGhsi5tewNN6GfzW0-L8VOBop52gZU09qxZ0ZVlZTFmiPy02- vv72_UlLMEuOp2dZpGPtrf3SnHaaOMBd3$ > _______________________________________________ NANOG mailing list https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.co m/?url=https*3A*2F*2Flists.nanog.org*2Farchives*2Flist*2Fnanog*40lists.n anog.org*2Fmessage*2FL7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC*2F&data= 05*7C02*7Cjstitt*40hop- electric.com*7C3686ee1866d749ada05408dd97a4cbfe*7C7707c291b2534 ee2bcd6557cdf0fea43*7C0*7C0*7C638833456248610067*7CUnknown*7 CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOi JXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ*3D*3D*7C0*7C*7C*7C&sdata=1*2 FXDLCU2W20dDZe1ktzC3V9hvj94DfEHMS1Puptd*2FRY*3D&reserved=0__;J SUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!Mak6IKo!OPoGhsi5tewNN6GfzW0- L8VOBop52gZU09qxZ0ZVlZTFmiPy02- vv72_UlLMEuOp2dZpGPtrf3SnHT8FXvJv$ <https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@li sts.nanog.org/message/L7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC/__;!!Mak6 IKo!OPoGhsi5tewNN6GfzW0-L8VOBop52gZU09qxZ0ZVlZTFmiPy02- vv72_UlLMEuOp2dZpGPtrf3SnHQvR4DA0$ >
CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If you are not expecting this message contact the sender directly via phone/text to verify.
_______________________________________________ NANOG mailing list https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@lis ts.nanog.org/message/IMGIIDN5ZQTLCFLGHQNKWNQWDVGYW2Q4/__;!!M ak6IKo!OPoGhsi5tewNN6GfzW0-L8VOBop52gZU09qxZ0ZVlZTFmiPy02- vv72_UlLMEuOp2dZpGPtrf3SnHW9GDXrX$