SUMMARY: Strange BGP phantom announce remaining

Stephane Bortzmeyer bortzmeyer at
Wed Nov 14 13:13:04 UTC 2001

First, the problem disappeared because Colt cleared the router which
was deceived by a bogus announce from Telecom Italia. Thanks.

On Mon, Nov 12, 2001 at 03:16:14PM +0100,
 Stephane Bortzmeyer <bortzmeyer at> wrote 
 a message of 33 lines which said:

> I probably made a stupid mistake when changing my BGP announces but I

Apparently, I made no mistake. According to analysis done by Jim Cowie
with data at, the change was properly
done. But at least one router in Telecom Italia did not receive it.

There was nothing we could do, since it took place at a far away
location. Without the action from Colt, we could have try to
re-announce the more specific route for ten minutes (let it
propagate), then to withdraw it again, hoping it will clear it. Next
time, I'll try :-)

> Does you have any idea why routers at Colt still see the old announce?

The question should have been "Why routers at Telecom Italia corrupted
Colt's database?". I received two hypothesis:

>From the Telia support (very helpful, like the Abovenet one):

>Cisco Bug Id CSCdt19638 :
>"BGP bestpath change not sent to peers
>Under rare circumstances, an updated Border Gateway Protocol (BGP)
>bestpath may not be propagated to the BGP peers of a router.
>Workaround: Enter the clear ip bgp * soft out EXEC command to update
>the peers with the current bestpath attributes."

[The workaround did not work in our case, since it was not *our*
router that send the wrong info.]

>From Neil J. McRae at Colt:

>We saw this route from a peer that was announcing us a huge number of
>routes that for some reason max-prefix didn't prevent from happening,
>although after rebooting, the box did take the session down. My guess
>is that the routes announced to us had sometype of corruption that
>didn't send it through the max-prefix subroutine properly to detect
>the number of routes being advertised.

Well, now it works, back to work.

> Configuration: Debian "woody", Linux kernel 2.4.9, Zebra routing
> software 0.91 and 0.92a (hence the copy to the Zebra

Nice software, no problem :-)

More information about the NANOG mailing list