4 ms·
Funny enough, I actually have a few routers with a DFZ, so I have an idea or two about how BGP works. My point is that: - if you drop a connection, especially
by ExoticPearTree 1y ago
Funny enough, I actually have a few routers with a DFZ, so I have an idea or two about how BGP works.
My point is that:
- if you drop a connection, especially one through which you announce the full routing table, it is going to create a lot of churn to your downstreams. Depending on the kind of routers they use, it can create some network instability for quite a while. And if you drop it again when you receive that malformed route, the instability continues
- removing only the malformed attribute maybe changes the way you treat traffic but you still route it. OK, you send it to maybe another interface, but no biggie
- if you’re using a DFZ setup, dropping that single route could blackhole traffic to that destination if you’re the only upstream to another router
- wbl 1y agoBlackholes are acceptable when it comes to broken attributes. Blackholes spreading is not.
- ExoticPearTree 1y agoIf you just drop malfromed attributes, there is no blackhole spreading.
- vbernat 1y agoIf the attribute says "encapsulate this", dropping just the attribute will create a blackhole as you will attract traffic that should be encapsulated and packets following this route will be dropped it if not.
- ExoticPearTree 1y agoI guess you're referring to RFC9012. Yes, but then again since you have logs of why it was dropped (like I suggested in my first post, to log everything dropped), you can easily troubleshoot the problem. A much better outcome than flapping a BGP session for no good reason and creating route churn and network instability.
- wbl 1y agoOr just drop the announced route (not the session) with the attribute you can't work with
- eqvinox 1y ago> Funny enough, I actually have a few routers with a DFZ, so I have an idea or two about how BGP works. And I'm TSC emeritus and >10 year maintainer on FRRouting, and active at IETF. Yet I hugely respect the other people there, all of whom have areas of expertise where they far outrank my own.
- ExoticPearTree 1y agoNice! (no sarcasm) I have very strong opinions about some subjects, one of them being BGP. I believe sessions should not be tear down just because you receive malformed data. You should be able to remove just the corrupt data. Or treat as a withdraw message like one of the RFC recommends. I for one one would like knobs to match on any attribute and value and remove/rewrite them at will. Imagine something akin to a very smart HTTP proxy.