Decoding BGP Notification Error

Following Log messages are normal in the IX scenario but decode the error message is quite interesting:
We will see why this error message popped up :


: %BGP-3-NOTIFICATION: sent to neighbor 10.10.194.236 2/7 (unsupported/disjoint capability) 0 bytes  FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 0039 0104 xx0D 00B4 C06A 1102 1C02 0601 0400 0200 0102 0280 0002 0202 0002 0246 0002 0641 0400 00C4 0D

its a raw hex out  of the BGP open message and starts from the marker  16byte FF so the actual output starts from 0039 
2 byte length value : 00 39 - 57
1 byte Type : 01 open message
1 byte Version : 04
2 byte ASN : xx0D  [ modified to remove the relevant information ]
2 byte holdtime : 00 B4 - 180 Seconds
4 byte BGP identifier : C06A 1102 [ modified ]
1 byte Optional parameter length : 1C   - 28 bytes
Refer RFC: http://tools.ietf.org/html/rfc5492

http://tools.ietf.org/html/draft-ietf-idr-ext-opt-param-02
http://www.iana.org/assignments/capability-codes/capability-codes.xml
02 0601 0400 0200 01   - 02 parameter type , capability 06 -length   01 : Multiprotocol Extensions for BGP-4
 02 0280 00  - 128 : route refresh
02 0202 00  - 02 : route refresh
02 0246 00  -   70 : enhanced route refresh
 02 0641 0400 00C4 0D :65 Support for 4-octet AS number capability

So the IOS i'm working with doesn't support enhanced route-refresh therefore its dropping the connection . 





Comments

WBB said…
Great information! This page just helped me decode a similar message I was getting. What I'm trying to figure out is how you determined your router didn't support enhanced router refresh based on your decoding.

Thanks again!
August 30, 2013 at 6:17 AM
Emmanuel Arul Gobinath said…
IOS version release date and this feature advertisement. I think you can check from most of the features from show bgp neig <> command. or debug :)
September 11, 2013 at 7:23 PM
Post a Comment

Popular posts from this blog

PPTP Server as Cisco for Mikrotik Client

Image
Following configuration explains the Cisco as PPTP server and connecting two sites: Following Configuration needed to enable the VPDN and default server: vpdn enable ! vpdn-group Mtik ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 interface Virtual-Template1 ip unnumbered Loopback0 peer default ip address pool IPPOOL1 ppp encrypt mppe auto required ppp authentication ms-chap-v2 ms-chap pap ip local pool IPPOOL1 192.168.150.10 192.168.150.224 Few more additional things we need to keep the same ip address for the user: aaa new-model ! ! aaa authentication ppp default local aaa authorization network default local ! aaa attribute list Gobi attribute type addr 192.168.150.13 service ppp protocol ip mandatory attribute type route "10.0.0.0 255.255.255.0 192.168.150.13" attribute type interface-config "description Gobi-test" Finally apply the attribute list to the user: username gobi password 0 test username gobi aaa attri...
Read more

l2tpv3 configuration reference

Image
Reference Comparing , Designing and Deploying VPNs chap - 02 : L2TPv3 is the enhanced version of L2TPv2 protocol. Mikrotik uses L2TPv2 i suppose but it offer another similar tunneling mechanism as EOIP. L2TPv3 in cisco provides Pseudo-wire services to the customer. L2TPv3 only require the IP connectivity between peers but it can transport Ethernet, 802.1Q , HDLC, PPP framerelay etc. Advantage over MPLS is the customer having the full control of their routing domain. L2TP depolyment methods having 3 topologies LAC - LNS , LNS - LNS , LAC - LAC Following Diagram explain simple LAC - LAC L2TPv3 setup. It uses two types of messages: control connection messages - used for signaling between LCEs session data messages - Used to transport layer 2 protocols and connections Data channel Message Header having Session ID & cookie to correctly associate with the tunnel Deploying dynamic Pseudowires session 1) configure CEF - Its default in IOSs now. 2) configure a loopback in...
Read more

proxy arp

Image
In the above diagram , both hosts don't have default routes. But both are in the same /16 subnet. When host1 tries to ping host2 will it be able to ping ? Yes this behaviour due to the Proxy Arp feature. Note: Cisco by default enabled the proxy arp feature you have to disable it manually . Check the following Debug messages "debug arp" from the router. When the Arp request for 192.168.20.101 received on the router Fa0/1 it replies with its own mac address of fa0/1. (c200.03fc.0001)and vice versa *Mar 1 00:11:43.071: IP ARP: rcvd req src 192.168.12.154 00aa.00f4.6800, dst 192.168.20.101 FastEthernet0/1 *Mar 1 00:11:43.075: IP ARP: sent rep src 192.168.20.101 c200.03fc.0001,dst 192.168.12.154 00aa.00f4.6800 FastEthernet0/1 *Mar 1 00:13:13.067: IP ARP: rcvd req src 192.168.20.101 00aa.0041.1d00, dst 192.168.12.154 FastEthernet0/0 *Mar 1 00:13:13.067: IP ARP: sent rep src 192.168.12.154 c200.03fc.0000, dst 192.168.20.101 00aa.0041.1d00 FastEther...
Read more