We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is Why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 568 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)


317 New Members signed up the last 30 days!


100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Forum Replies

  1. My company have two ISP connections but we only use 1 for all our traffic and the other was is for backup situation. We were planning to buy a netgear router (http://www.netgear.com.au/business/products/security/FVS336G.aspx#tab-features). There are two WAN port and it has load sharing capability. Are you saying that in the configuration we will not be able to set 80% to ISP 1 and 20% to ISP2 and it will be 50/50 distribution only? and if we do want to send 80% trafic through 1 ISP and 20% through another we don't have an other option but to buy beefy routers to run BGP. Moreover, I heard that bgp is more about controlling incoming traffic flow from multiple ISPs to your network (you may be running multiple webserver in your network)rather than outgoing traffic from your network?

  2. Hi Lorenzo,

    Thanks, glad to hear you like it!

    That capture looks weird...I haven't seen it before and I can't find anything about it. Where did you find it?

    Seeing multiple update messages in one frame is normal but I haven't seen open + keepalive combined. Here's a wireshark capture I just did on two IOS 15 routers with external BGP:




  3. Hi Lorenzo,

    I took a look, with google translate I can get pretty far :slight_smile:

    About the update message...

    • When the path attributes for prefixes are the same then BGP will combine them in a single update message.

    • When the path attributes for prefixes are different then BGP will use multiple updates messages but they can be in the same frame.


    Take a look at these two wireshark captures. In the first one the path attributes are the same and in the second one they are different.

    BGP same path attributes

    BGP different path attributes

    Hope this helps.


  4. Excellent explanation about multiple updates messages when the path attributes for prefixes are different. But I think there is another reason for such behavior. As you can see in your capture: https://www.cloudshark.org/captures/89f1795591f6 second update message is empty.
    I get the same behavior in GNS3 when routers start session between each other they send "update message, update message" to each other and where second update is empty. I attaches screenshot from your capture.

    And about different messages in the same frame. On the http://linkmeup.ru/blog/65.html is written that in the "open message, keepalive message" keepalive message is sent as response to previous open message and this keepalive indicates to router that session can change state from open to established. But I think it's not valid reason for such behavior and besides neither your nor mine captures don't indicates that type of messages. And "keepalive message, keepalive message" seems very stange, what is the reason for sending two keepalive messages in one frame? Maybe it's ASA thing? Because in the second article http://www.4pronetworks.co.uk/blog/asa-bgp-pass-through/ these messages ( "open message, keepalive message" and "keepalive message, keepalive message") sent only by ASA and router don't send those messages in one frame instead it sent them separatly.

    Thank you for response!


24 more replies! Ask a question or join the discussion by visiting our Community Forum