For what it's worth, while we didn't see sessions reset, I do recall that we have bgp-error-tolerance enabled on our Juniper routers, so it's possible that kept our sessions from resetting. Customer that saw sessions drop is running Arista. John Stitt ________________________________ From: Ryan Rawdon via NANOG <nanog@lists.nanog.org> Sent: Tuesday, May 20, 2025 8:46 AM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: Ryan Rawdon <ryan@u13.net> Subject: Re: BGP malformed update/attribute list On 2025-05-20 09:31, Simon Lockhart via NANOG wrote:
Did anyone see BGP flaps this morning at about 07:01 UTC as a result of BGP malformed update?
I was just mentioning this with you on IRC, here's the details of what we saw. We were most-impacted in Virginia at our two locations there, 11 of 12 transit IPv4 sessions (3 uptream ASNs) failed. IPv6 was unaffected. First instance at May 20 07:01:51 Last instance of that message in our logs was at May 20 07:08:08 Other regions across our global locations saw it, but only one or two sessions/upstreams here and there.
It flapped one of our iBGP sessions:
May 20 08:01:51.150 BST: %BGP-3-NOTIFICATION: received from neighbor XXX.XXX.XXX.XXX 3/1 (update malformed) 31 bytes E0281C00 00000000 00000000 00000000 00
Another ISP saw the same thing...
code 3 (Update Message Error) subcode 1 (invalid attribute list), Data: e0 28 1c 00 00 00
Is there a new BGP rogue update out there?
Simon _______________________________________________ NANOG mailing list https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nanog.org%2Farchives%2Flist%2Fnanog%40lists.nanog.org%2Fmessage%2FGQP6V6BONTN2BPD7XSGW27WLZE5F3L7K%2F&data=05%7C02%7Cjstitt%40hop-electric.com%7C3686ee1866d749ada05408dd97a4cbfe%7C7707c291b2534ee2bcd6557cdf0fea43%7C0%7C0%7C638833456248584078%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=qUlr65OWUt6HXJYNgHCbWIIH%2B4%2By8ciuKSfrFRmsz6k%3D&reserved=0<https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/GQP6V6BONTN2BPD7XSGW27WLZE5F3L7K/>
_______________________________________________ NANOG mailing list https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nanog.org%2Farchives%2Flist%2Fnanog%40lists.nanog.org%2Fmessage%2FL7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC%2F&data=05%7C02%7Cjstitt%40hop-electric.com%7C3686ee1866d749ada05408dd97a4cbfe%7C7707c291b2534ee2bcd6557cdf0fea43%7C0%7C0%7C638833456248610067%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=1%2FXDLCU2W20dDZe1ktzC3V9hvj94DfEHMS1Puptd%2FRY%3D&reserved=0<https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/L7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC/> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If you are not expecting this message contact the sender directly via phone/text to verify.