BGP Messages

Lab and common header

Use R1 and R2 from the previous lessons. R1’s Loopback10 represents 198.51.100.0/24; its baseline network statement originates that prefix.

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.0
exit
router bgp 65010
 bgp router-id 10.255.0.1
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.2 remote-as 65020
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.2 activate
  network 198.51.100.0 mask 255.255.255.0
 exit-address-family
end

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router bgp 65020
 bgp router-id 10.255.0.2
 bgp log-neighbor-changes
 timers bgp 30 90
 no bgp default ipv4-unicast
 neighbor 192.0.2.1 remote-as 65010
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.1 activate
 exit-address-family
end

The common header is 19 bytes. TCP is a byte stream: one captured packet can hold several BGP messages, and one BGP message can span several TCP segments. These are selected decoded fields, not fabricated full packet dumps.

OPEN

Each side sends OPEN after TCP connects. Validate version, expected peer AS, hold time, router identifier and optional capabilities before exchanging routes.

BGP Type: OPEN (1)
Version: 4
My AS: 65010
Hold Time: 90 seconds
BGP Identifier: 10.255.0.1
Optional parameters: capabilities
  Multiprotocol: AFI 1, SAFI 1 (IPv4 unicast)
  Route Refresh
  Four-octet AS Number: 65010

The configured router ID is a protocol identifier; it need not be the TCP source address. A four-octet-AS capability carries the full ASN when required. Address-family support must be compatible for the routes being exchanged.

Timer agreement

These labs propose 90 seconds on both sides. If R2 instead proposes 180 seconds, the agreed hold time is 90; keepalive intervals are chosen locally in relation to that value. A negotiated hold time of zero disables hold/keepalive timer operation for the session.

R1# show ip bgp neighbors 192.0.2.2 | include hold time
  Last read 00:00:12, last write 00:00:12, hold time is 90, keepalive interval is 30 seconds

UPDATE

An UPDATE can announce reachability, withdraw it, or do both. For ordinary IPv4 unicast, examine the withdrawn prefix list, path attributes and NLRI.

BGP Type: UPDATE (2)
Withdrawn Routes Length: 0
Path attributes (selected):
  ORIGIN: IGP (i)
  AS_PATH: 65010
  NEXT_HOP: 192.0.2.1
NLRI: 198.51.100.0/24

R2# show ip bgp 198.51.100.0/24
     Network          Next Hop            Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.1            0             0 65010 i

The received prefix and next hop match the UPDATE. Attribute flags identify optional/well-known, transitive, partial and extended-length handling; detailed attribute policy belongs in later lessons.

Now stop originating only this prefix on R1:

router bgp 65010
 address-family ipv4 unicast
  no network 198.51.100.0 mask 255.255.255.0
 exit-address-family

BGP Type: UPDATE (2)
Withdrawn Routes Length: 4
Withdrawn Routes: 198.51.100.0/24
Total Path Attribute Length: 0
NLRI: none

R2# show ip bgp 198.51.100.0/24
% Network not in table

R2# show ip bgp summary
BGP router identifier 10.255.0.2, local AS number 65020
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.1       4  65010      12      12      1   0    0 00:02:00 0

The /24 withdrawal needs one prefix-length byte and three address bytes. The path disappears while the session remains Established with zero prefixes. Restore R1’s original network statement before the next exercise.

router bgp 65010
 address-family ipv4 unicast
  network 198.51.100.0 mask 255.255.255.0
 exit-address-family

KEEPALIVE

A KEEPALIVE is exactly the 19-byte common header, with type 4 and no body. It completes the handshake in OpenConfirm and refreshes the hold timer in Established.

BGP Type: KEEPALIVE (4)
Length: 19 bytes
Payload: none

A valid UPDATE also refreshes the hold timer. Session failure is based on the negotiated hold time expiring, not literally counting three missing KEEPALIVEs. The configured 30/90 pair is a lab choice, not a universal protocol default.

NOTIFICATION

A NOTIFICATION carries an error code, subcode and optional diagnostic data, then ends the session. To observe an OPEN rejection, temporarily give R2 the wrong expected AS for R1.

router bgp 65020
 neighbor 192.0.2.1 remote-as 65030

BGP Type: NOTIFICATION (3)
Error Code: 2 (OPEN Message Error)
Error Subcode: 2 (Bad Peer AS)
Cause: R2 expected AS 65030; R1 announced AS 65010

R2# show ip bgp neighbors 192.0.2.1 | include Last reset
  Last reset 00:00:05, due to BGP Notification sent, OPEN Message Error / Bad Peer AS

Restore the expected AS, wait for the handshake, then verify the session:

router bgp 65020
 neighbor 192.0.2.1 remote-as 65010

R2# show ip bgp summary
BGP router identifier 10.255.0.2, local AS number 65020
Neighbor        V     AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
192.0.2.1       4  65010      12      12      1   0    0 00:02:00 1

Not every malformed UPDATE must reset the entire session: modern error handling can discard an attribute or treat affected routes as withdrawn. A sent NOTIFICATION itself still terminates the session.

Other message support

The four types above are the base protocol messages. ROUTE-REFRESH is an additional message, type 5, used with the relevant capability to request re-advertisement. The classic maximum message length is 4096 bytes; negotiated extended-message support permits up to 65535 for applicable message types, excluding OPEN and KEEPALIVE. Do not assume every peer supports it.