On 2025-05-20 09:31, Simon Lockhart via NANOG wrote:
Did anyone see BGP flaps this morning at about 07:01 UTC as a result of
BGP
malformed update?
I was just mentioning this with you on IRC, here's the details of what
we saw. We were most-impacted in Virginia at our two locations there,
11 of 12 transit IPv4 sessions (3 uptream ASNs) failed. IPv6 was
unaffected.
First instance at
May 20 07:01:51
Last instance of that message in our logs was at
May 20 07:08:08
Other regions across our global locations saw it, but only one or two
sessions/upstreams here and there.
It flapped one of our iBGP sessions:
May 20 08:01:51.150 BST: %BGP-3-NOTIFICATION: received from neighbor
XXX.XXX.XXX.XXX 3/1 (update malformed) 31 bytes E0281C00 00000000
00000000 00000000 00
Another ISP saw the same thing...
code 3 (Update Message Error) subcode 1 (invalid attribute list),
Data: e0 28 1c 00 00 00
Is there a new BGP rogue update out there?
Simon
_______________________________________________
NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/GQP6V6BONTN2BPD7XSGW27WLZE5F3L7K/
_______________________________________________
NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/L7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC/
