Question about normal ops - BGP Flaps nightly

Fri Nov 22 00:20:07 UTC 2019

On Fri, Nov 22, 2019 at 12:54 AM Tom Beecher <beecher at beecher.cc> wrote:
>
> I agree that this sounds like an automated process in some way.
>
> I would suspect that either a vendor code update changed something such that a given command that would not cause session reset now does, or they changed their automation to include a command that would cause a reset without realizing it/slipped through the cracks / etc.
>

thanks to some private chat with another nanog participant it was
noted the reason for failure is:
  "Error event Operation timed out(60) for I/O session - closing it"

This is fine, I suppose, except that I have v4/v6 sessions on the same
ptp link/path. So, if v6 times out I'd have expected v4 to also
timeout.
Strangely I had thought we were told the 2 links we have land on 2
different devices, but router-id tells me that's false as well. :(
The sessions appear to reset on both devices (according to syslog) at
the same time, I had thought (because our alerter is telling me) the
sessions had a gap between the 2 drops.

The physical payer is some bidi fiber path across an L2 (ether)
network to the provider, perhaps the problem isn't on the l3/bgp parts
here, but in the l2 network between. we are at the end of our time
here so I think I'll gather some logs and see if the provider can make
sense of the issues.

> On Thu, Nov 21, 2019 at 9:18 AM Mel Beckman <mel at beckman.org> wrote:
>>
>> No. There should be no reason to bounce the session. Do you have soft updates turn on?
>>
>> -mel via cell
>>
>> > On Nov 21, 2019, at 1:46 AM, Christopher Morrow <morrowc.lists at gmail.com> wrote:
>> >
>> > Howdy!
>> > A question of interest to me, currently, is whether it's normal for
>> > providers to cause BGP flaps to their customers nightly... This seems,
>> > in my case, to be the provider PROBABLY updating prefix-filters on my
>> > session(s).
>> >
>> > Particularly AS56554 is currently getting v4/v6 transit from 2
>> > providers, one of which we have 2 links toward. That provider appears
>> > to flap both of our ipv6 (only) bgp peers each night at about the same
>> > time each night. This smells like: "filter updates', but something
>> > that's different than the v4 filter update? (or perhaps they have no
>> > v4 filtering to update?)
>> >
>> > In the end, should customers expect nightly (or on a regular cadence)
>> > to see their sessions bounce? It hasn't been my experience in other
>> > situations...
>> >
>> > -chris