Seeing a lot of ROUTING-FIB-3-UPD_MSG_TOO_BIG messages today
Hello everyone, I've seen this a bit in the past with 1-2 routes, but today it's been happening basically all morning with several different routes. ROUTING-FIB-3-UPD_MSG_TOO_BIG I've chased it down from a vendor level and they implied that it is just informational, my question is why do these sort of updates seem to be sent to the Internet's routing table in bursts? Is that a testing thing? Is anyone else seeing this today as well?
Hey Drew,
I’ve seen this a bit in the past with 1-2 routes, but today it’s been happening basically all morning with several different routes. ROUTING-FIB-3-UPD_MSG_TOO_BIG I’ve chased it down from a vendor level and they implied that it is just informational, my question is why do these sort of updates seem to be sent to the Internet’s routing table in bursts?
This is really cisco-nsp issue, not nanog, nanog is about unfalsiable politics and explaining how simple things are which you've never done at any scale or availability needs. You probably have 'bgp attribute-download' configured, which means things like communities, as-paths etc are given for FIB consumption, usually because you want netflow to export AS data, instead of enriching it at the receiver. So likely you have some RIB entry with a very long path or many communities, and this made the IPC message too large, and those attributes were not sent to the FIB. The prefix and forwarding information is there, juste the attribute download failed. -- ++ytti
Firstly 😉, Second, I was mostly just mentioning it because of the quantity of routes which fit this criteria since about 9AM (ET). It's not that uncommon to see this on one prefix on a monthly basis, the velocity of occurrence today made it seems "different". That was the only reason I mentioned it. Thanks and sorry for my noise. -Drew -----Original Message----- From: Saku Ytti <saku@ytti.fi> Sent: Monday, April 25, 2022 12:35 PM To: Drew Weaver <drew.weaver@thenap.com> Cc: nanog@nanog.org Subject: Re: Seeing a lot of ROUTING-FIB-3-UPD_MSG_TOO_BIG messages today Hey Drew,
I’ve seen this a bit in the past with 1-2 routes, but today it’s been happening basically all morning with several different routes. ROUTING-FIB-3-UPD_MSG_TOO_BIG I’ve chased it down from a vendor level and they implied that it is just informational, my question is why do these sort of updates seem to be sent to the Internet’s routing table in bursts?
This is really cisco-nsp issue, not nanog, nanog is about unfalsiable politics and explaining how simple things are which you've never done at any scale or availability needs. You probably have 'bgp attribute-download' configured, which means things like communities, as-paths etc are given for FIB consumption, usually because you want netflow to export AS data, instead of enriching it at the receiver. So likely you have some RIB entry with a very long path or many communities, and this made the IPC message too large, and those attributes were not sent to the FIB. The prefix and forwarding information is there, juste the attribute download failed. -- ++ytti
On Mon, 25 Apr 2022 at 19:43, Drew Weaver <drew.weaver@thenap.com> wrote:
Firstly 😉,
Second, I was mostly just mentioning it because of the quantity of routes which fit this criteria since about 9AM (ET). It's not that uncommon to see this on one prefix on a monthly basis, the velocity of occurrence today made it seems "different".
Do you see prefixes with long AS_PATH, are you comfortable at filtering them? There is a good chance that you do, and if you drop them in your ingress policy, the message goes away.
Thanks and sorry for my noise.
No noise, legitimate operational concern and question, but in a forum where signals are lost. -- ++ytti
Thus spake Drew Weaver (drew.weaver@thenap.com) on Mon, Apr 25, 2022 at 04:21:53PM +0000:
Hello everyone,
I've seen this a bit in the past with 1-2 routes, but today it's been happening basically all morning with several different routes.
ROUTING-FIB-3-UPD_MSG_TOO_BIG
I've chased it down from a vendor level and they implied that it is just informational, my question is why do these sort of updates seem to be sent to the Internet's routing table in bursts?
Is that a testing thing?
Is anyone else seeing this today as well?
103.139.18.0/23 139009 139009 139009 139009 139009 ... Dale
participants (3)
-
Dale W. Carder -
Drew Weaver -
Saku Ytti