At the risk of "me too" noise, we felt this as well, but only on exabgp 4.2.21.
-Michael > -----Original Message----- > From: John Stitt via NANOG <nanog@lists.nanog.org> > Sent: Tuesday, May 20, 2025 8:49 AM > To: North American Network Operators Group <nanog@lists.nanog.org> > Cc: John Stitt <jst...@hop-electric.com> > Subject: Re: BGP malformed update/attribute list > > For what it's worth, while we didn't see sessions reset, I do recall that we > have > bgp-error-tolerance enabled on our Juniper routers, so it's possible that kept > our sessions from resetting. > > Customer that saw sessions drop is running Arista. > > John Stitt > > > ________________________________ > From: Ryan Rawdon via NANOG <nanog@lists.nanog.org> > Sent: Tuesday, May 20, 2025 8:46 AM > To: North American Network Operators Group <nanog@lists.nanog.org> > Cc: Ryan Rawdon <r...@u13.net> > Subject: Re: BGP malformed update/attribute list > > > > On 2025-05-20 09:31, Simon Lockhart via NANOG wrote: > > Did anyone see BGP flaps this morning at about 07:01 UTC as a result of > > BGP > > malformed update? > > I was just mentioning this with you on IRC, here's the details of what > we saw. We were most-impacted in Virginia at our two locations there, > 11 of 12 transit IPv4 sessions (3 uptream ASNs) failed. IPv6 was > unaffected. > > First instance at > May 20 07:01:51 > > Last instance of that message in our logs was at > May 20 07:08:08 > > Other regions across our global locations saw it, but only one or two > sessions/upstreams here and there. > > > > > It flapped one of our iBGP sessions: > > > > May 20 08:01:51.150 BST: %BGP-3-NOTIFICATION: received from > neighbor > > XXX.XXX.XXX.XXX 3/1 (update malformed) 31 bytes E0281C00 00000000 > > 00000000 00000000 00 > > > > Another ISP saw the same thing... > > > > code 3 (Update Message Error) subcode 1 (invalid attribute list), > > Data: e0 28 1c 00 00 00 > > > > Is there a new BGP rogue update out there? > > > > Simon > > _______________________________________________ > > NANOG mailing list > > > https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.co > m/?url=https*3A*2F*2Flists.nanog.org*2Farchives*2Flist*2Fnanog*40lists.n > anog.org*2Fmessage*2FGQP6V6BONTN2BPD7XSGW27WLZE5F3L7K*2F&da > ta=05*7C02*7Cjstitt*40hop- > electric.com*7C3686ee1866d749ada05408dd97a4cbfe*7C7707c291b2534 > ee2bcd6557cdf0fea43*7C0*7C0*7C638833456248584078*7CUnknown*7 > CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOi > JXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ*3D*3D*7C0*7C*7C*7C&sdata=qUlr > 65OWUt6HXJYNgHCbWIIH*2B4*2By8ciuKSfrFRmsz6k*3D&reserved=0__;JSU > lJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!Mak6IKo!OPoGhsi5tewNN6GfzW0- > L8VOBop52gZU09qxZ0ZVlZTFmiPy02- > vv72_UlLMEuOp2dZpGPtrf3SnHUCJSddn$ > <https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@li > sts.nanog.org/message/GQP6V6BONTN2BPD7XSGW27WLZE5F3L7K/__;!!M > ak6IKo!OPoGhsi5tewNN6GfzW0-L8VOBop52gZU09qxZ0ZVlZTFmiPy02- > vv72_UlLMEuOp2dZpGPtrf3SnHaaOMBd3$ > > _______________________________________________ > NANOG mailing list > https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.co > m/?url=https*3A*2F*2Flists.nanog.org*2Farchives*2Flist*2Fnanog*40lists.n > anog.org*2Fmessage*2FL7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC*2F&data= > 05*7C02*7Cjstitt*40hop- > electric.com*7C3686ee1866d749ada05408dd97a4cbfe*7C7707c291b2534 > ee2bcd6557cdf0fea43*7C0*7C0*7C638833456248610067*7CUnknown*7 > CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOi > JXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ*3D*3D*7C0*7C*7C*7C&sdata=1*2 > FXDLCU2W20dDZe1ktzC3V9hvj94DfEHMS1Puptd*2FRY*3D&reserved=0__;J > SUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!Mak6IKo!OPoGhsi5tewNN6GfzW0- > L8VOBop52gZU09qxZ0ZVlZTFmiPy02- > vv72_UlLMEuOp2dZpGPtrf3SnHT8FXvJv$ > <https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@li > sts.nanog.org/message/L7KYGTXIHKBS3RSGZFCCXB6KEFBMDRBC/__;!!Mak6 > IKo!OPoGhsi5tewNN6GfzW0-L8VOBop52gZU09qxZ0ZVlZTFmiPy02- > vv72_UlLMEuOp2dZpGPtrf3SnHQvR4DA0$ > > > CAUTION: This email originated from outside of the organization. Do not click > links or open attachments unless you recognize the sender and know the > content is safe. If you are not expecting this message contact the sender > directly via phone/text to verify. > > _______________________________________________ > NANOG mailing list > https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@lis > ts.nanog.org/message/IMGIIDN5ZQTLCFLGHQNKWNQWDVGYW2Q4/__;!!M > ak6IKo!OPoGhsi5tewNN6GfzW0-L8VOBop52gZU09qxZ0ZVlZTFmiPy02- > vv72_UlLMEuOp2dZpGPtrf3SnHW9GDXrX$ _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/FJC2Q3S7JJ3UJWOBTX57SPWAZ2552DCN/
