rayhaan/ferrix
0
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
1399cbd39ffe6cb188f6f8f98397d291586f45d3
ferrix/slides/sections/03-bgp-update.md
T
Rayhaan JaufeerallyandClaude Fable 5.1 1399cbd39f slides: "Hands-on BGP", restructured into five sections 
- Title is now "Hands-on BGP"; the AS-path diagram is gone from the cover.
- Sections: IPv6 addresses and prefixes; where AS numbers and prefixes
  come from (IANA, RIRs, the RIPE database, IRR vs RPKI); BGP and the
  bytes of an UPDATE; IP transit vs Internet exchanges (the peering LAN as
  an Ethernet segment, route servers); the lab (ferrix, pr01.rue, SwissIX,
  NL-ix, France-IX, DE-CIX, transit).
- The UPDATE walked through in section 3 is a real 94-byte capture from
  ferrix for 2a0d:d741:1::/48. Vertical slides light up one part at a
  time with its decode; the generator asserted every quoted number
  against the capture. Session counts come from the tracked bird.conf,
  the route6 object from the RPSL file, SwissIX's LAN from PeeringDB.
- New components: focusable bytes, decode table, prefix bits, and SVG
  diagrams drawn in the theme's colours.
- Opening index.html straight from disk used to give a title and empty
  panels, because browsers block the module and the section files there.
  The page now explains that, and also reports a failed reveal.js load.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-20 21:41:31 +02:00

8.6 KiB
Raw Blame History

BGP, down to the bytes

Notes: Section 3. The aim: by the end, the bytes view on the lab page reads like text.

BGP in one slide

  • Runs over TCP, port 179, between neighbours you configure by hand
  • Each side tells the other its best route per prefix
  • Only changes are sent: no periodic refresh
  • If the session drops, every route learned over it is gone

Notes: No discovery, no authentication of content, no notion of truth. A neighbour says "I can reach X" and you believe it, subject to your filters.

Four kinds of message

Type Name Says
1 OPEN who I am: AS number, router ID, capabilities
2 UPDATE these prefixes are reachable, those no longer are
3 NOTIFICATION something is wrong, I am closing the session
4 KEEPALIVE still here

OPEN, OPEN, KEEPALIVE, KEEPALIVE, and then it is all UPDATEs.

Notes: There is a fifth, ROUTE-REFRESH: "send me everything again, my policy changed".

The shape of an UPDATE

Bytes Field
19 header: marker, length, type
2 + n withdrawn routes: prefixes that are no longer reachable
2 + n path attributes: everything about the route
the rest NLRI: the IPv4 prefixes being announced

One UPDATE carries one set of attributes, and every prefix that shares them.

A real one: 94 bytes

headerlengthspath attributesNLRI
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec

2a0d:d741:1::/48, as the lab daemon sent it. The same view is on the lab page under bytes.

Notes: Captured from ferrix, not typed. Press down to walk through it part by part. Note there is nothing yellow: the NLRI field is empty. Hold that thought.

Header

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec
ff × 16marker. Once carried authentication, now just filler to find message boundaries
00 5elength of the whole message: 94 bytes (maximum 4096)
02type 2 = UPDATE

Two lengths

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec
00 000 bytes of withdrawn routes: nothing is being taken back
00 4771 bytes of path attributes follow
94 − 19 − 2 − 2 − 71 = 0 bytes left over for NLRI

ORIGIN

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec
40flags: well-known, transitive
01type 1 = ORIGIN
011 byte of value
00IGP: the route was originated inside this AS

Every attribute is flags, type, length, value.

AS_PATH

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec
40 02 06well-known, transitive; type 2; 6 bytes
02an AS_SEQUENCE, order matters
01of 1 AS number
fa 56 ea 014200000001, the lab daemon. Four bytes each (RFC 6793)

Each network prepends itself on the way out. The length of this list is what best-path selection compares.

MP_REACH_NLRI: where IPv6 lives

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec
80 0e 1coptional, non-transitive; type 14; 28 bytes
00 02 · 01address family IPv6, unicast
10 · 00…01next hop, 16 bytes: ::1
00reserved
30 · 2a 0d d7 41 00 0148 bits of prefix: 2a0d:d741:1::/48

Notes: BGP-4 was built for IPv4: its NLRI field cannot carry anything else. RFC 4760 bolts other address families on as an attribute, each with its own next hop. A prefix is sent as a bit count plus only as many bytes as the count needs. The next hop is ::1 because the daemon and the router share a machine.

LARGE_COMMUNITIES

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 5e 02 00 00 00 47 40 01 01 00 40 02 06 02 01 fa 56 ea 01 80 0e 1c 00 02 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 30 2a 0d d7 41 00 01 c0 20 18 00 03 34 74 00 00 00 00 00 00 00 00 00 03 34 74 00 00 00 01 00 00 a5 ec
c0 20 18optional, transitive; type 32; 24 bytes = two communities
00033474 · 0 · 0210036:0:0 our router: announce nowhere…
00033474 · 1 · 0000a5ec210036:1:42476 …except to AS42476, the SwissIX route servers

Three 32-bit numbers. They mean whatever the receiving network says they mean.

The flags byte

Bit Set means Clear means
0x80 optional well-known: every BGP speaker must understand it
0x40 transitive: pass it on, even if not understood drop it at the next hop
0x20 partial: someone on the way did not understand it
0x10 length field is 2 bytes 1 byte

Transitive is why a community you set can act three networks away.

Reference in new issue View Git Blame Copy Permalink