On 2025-05-20 09:31, Simon Lockhart via NANOG wrote:
Did anyone see BGP flaps this morning at about 07:01 UTC as a result of BGP malformed update?
I was just mentioning this with you on IRC, here's the details of what we saw. We were most-impacted in Virginia at our two locations there, 11 of 12 transit IPv4 sessions (3 uptream ASNs) failed. IPv6 was unaffected. First instance at May 20 07:01:51 Last instance of that message in our logs was at May 20 07:08:08 Other regions across our global locations saw it, but only one or two sessions/upstreams here and there.
It flapped one of our iBGP sessions:
May 20 08:01:51.150 BST: %BGP-3-NOTIFICATION: received from neighbor XXX.XXX.XXX.XXX 3/1 (update malformed) 31 bytes E0281C00 00000000 00000000 00000000 00
Another ISP saw the same thing...
code 3 (Update Message Error) subcode 1 (invalid attribute list), Data: e0 28 1c 00 00 00
Is there a new BGP rogue update out there?
Simon _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/GQP6V6BO...