We had a max IPv4 prefix count of 2000 with a warning when it hit 90%. At 10:20 am our BGP session was torn down when it apparently exceeded 2000: Aug 18 14:09:18 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 18 14:09:18 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 18 14:14:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 18 14:14:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 18 14:19:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 18 14:19:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 18 14:24:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 18 14:24:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 18 14:29:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 18 14:29:17 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 21 06:12:20 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 21 06:12:50 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 21 06:17:19 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 21 06:17:50 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 21 06:22:19 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 21 06:27:19 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 21 06:27:50 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 21 06:32:19 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1: exceeds warning limit 1800 Aug 21 06:32:50 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2: exceeds warning limit 1800 Aug 21 10:20:10 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.1 exceeds maximum prefix limit...shutdown Aug 21 10:20:10 192.168.0.85 BGP: Peer 206.108.255.1 DOWN (Peer had exceeded the prefix limit) Aug 21 10:20:11 192.168.0.85 BGP: No. of prefix received from BGP Peer 206.108.255.2 exceeds maximum prefix limit...shutdown Aug 21 10:20:11 192.168.0.85 BGP: Peer 206.108.255.2 DOWN (Peer had exceeded the prefix limit) The Cacti graph (http://micelg.usinternet.com/cacti/graph.php?action=view&local_graph_id=236&rra_id=all) doesn't show that ... but is there any further confirmation that there was a short burst in routes advertised by the RR's? Frank
On Sun, Aug 21, 2016 at 04:50:17PM +0000, Frank Bulk wrote:
The Cacti graph (http://micelg.usinternet.com/cacti/graph.php?action=view&local_graph_id=236&rra_id=all) doesn't show that ... but is there any further confirmation that there was a short burst in routes advertised by the RR's?
Hmm, interesting, the BIRD servers are configured for a max prefix count of 1024 on IPv4, and there are a few alarm log entries at 10:21AM & 10:22AMshowing the prefix count going above for a specific session, and a statement that their session was shutdown and restarted. I'd have thought there wouldn't be leakage beyond the config'd limit, but apparently there is? -- Doug McIntyre <merlyn@iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades
Thanks for confirming. Frank -----Original Message----- From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Doug McIntyre Sent: Monday, August 22, 2016 12:55 AM To: MICE-DISCUSS@LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Prefix count On Sun, Aug 21, 2016 at 04:50:17PM +0000, Frank Bulk wrote:
The Cacti graph (http://micelg.usinternet.com/cacti/graph.php?action=view&local_graph_id=236&rra_id=all) doesn't show that ... but is there any further confirmation that there was a short burst in routes advertised by the RR's?
Hmm, interesting, the BIRD servers are configured for a max prefix count of 1024 on IPv4, and there are a few alarm log entries at 10:21AM & 10:22AMshowing the prefix count going above for a specific session, and a statement that their session was shutdown and restarted. I'd have thought there wouldn't be leakage beyond the config'd limit, but apparently there is? -- Doug McIntyre <merlyn@iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades
participants (2)
-
Doug McIntyre -
Frank Bulk