BGP Aggregate with AS_SET Packet Capture

This packet capture contains a BGP UPDATE for an aggregate route, 172.16.0.0/16, configured with aggregate-address ... as-set. The more specific routes behind it came from AS 2 and AS 3. Instead of losing that information, the aggregate carries both AS numbers in a special path segment: an AS_SET, written in curly braces.

You can see the AS_SET segment, and the AGGREGATOR attribute that tells everyone who created the aggregate. The BGP aggregate AS_SET lesson explains why as-set is used. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The aggregate UPDATE (packet 1)

Border Gateway Protocol - UPDATE Message
    Length: 74
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 48
    Path attributes
        Path Attribute - ORIGIN: IGP
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 1 {2, 3}
            Type Code: AS_PATH (2)
            Length: 16
            AS Path segment: 1
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 1
            AS Path segment: {2, 3}
                Segment type: AS_SET (1)
                Segment length (number of ASN): 2
                AS4: 2
                AS4: 3
        Path Attribute - AGGREGATOR: AS: 1 origin: 192.168.14.1
            Type Code: AGGREGATOR (7)
            Length: 8
            Aggregator AS: 1
            Aggregator origin: 192.168.14.1
        Path Attribute - NEXT_HOP: 192.168.14.1
            Type Code: NEXT_HOP (3)
            Length: 4
            Next hop: 192.168.14.1
        Path Attribute - MULTI_EXIT_DISC: 0
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
    Network Layer Reachability Information (NLRI)
        172.16.0.0/16
            NLRI prefix length: 16
            NLRI prefix: 172.16.0.0

Here’s what stands out:

• AS_PATH “1 {2, 3}”: two segments. First an AS_SEQUENCE with AS 1, the aggregating AS, which added itself when it sent the route to its eBGP neighbor. Then an AS_SET with AS 2 and 3, the ASes the contributing routes came from.
• AS_SET, segment type 1: an unordered set. It says “these ASes are somewhere behind this aggregate”, without an order. For path length, a whole AS_SET counts as one AS, however many it contains.
• Loop prevention still works: AS 2 and AS 3 will reject this aggregate because they see their own AS number in the path. That’s the reason to use as-set.
• AGGREGATOR: AS 1, 192.168.14.1: an optional transitive attribute with the AS and router ID of the router that created the aggregate.
• No ATOMIC_AGGREGATE: that attribute warns that path information was lost during aggregation. With an AS_SET, nothing is lost, so this router doesn’t add it.
• 172.16.0.0/16: the aggregate itself. The second, empty UPDATE in the same packet is the End-of-RIB marker.