BGP NO_ADVERTISE Community Packet Capture

This packet capture contains a BGP UPDATE with the well-known NO_ADVERTISE community. The route is 2.2.2.2/32, sent over iBGP from 192.168.23.2 to 192.168.23.3. The community tells the receiving router: use this route yourself, but don’t advertise it to any BGP neighbor, internal or external.

In the packet, a community is just a 32-bit value in the COMMUNITIES attribute. The BGP community no-advertise lesson shows the configuration and the result, and BGP communities explained covers the other well-known communities. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The UPDATE (packet 1)

Border Gateway Protocol - UPDATE Message
    Length: 63
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 35
    Path attributes
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: empty
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: AS_PATH (2)
            Length: 0
        Path Attribute - NEXT_HOP: 192.168.23.2
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: NEXT_HOP (3)
            Length: 4
            Next hop: 192.168.23.2
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - LOCAL_PREF: 100
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: LOCAL_PREF (5)
            Length: 4
            Local preference: 100
        Path Attribute - COMMUNITIES: NO_ADVERTISE
            Flags: 0xc0, Optional, Transitive, Complete
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: NO_ADVERTISE
                Community Well-known: NO_ADVERTISE (0xffffff02)
    Network Layer Reachability Information (NLRI)
        2.2.2.2/32
            NLRI prefix length: 32
            NLRI prefix: 2.2.2.2

What do we see here?

• COMMUNITIES, type code 8: one attribute that can hold many 4-byte communities. This one holds a single value.
• Flags 0xc0: optional transitive: routers that don’t care about communities still pass them on.
• NO_ADVERTISE = 0xFFFFFF02: well-known communities use the reserved range 0xFFFF0000-0xFFFFFFFF. 0xFFFFFF01 is NO_EXPORT (don’t send to eBGP neighbors), 0xFFFFFF02 is NO_ADVERTISE (don’t send to any neighbor), 0xFFFFFF03 is NO_EXPORT_SUBCONFED. Normal communities like 65000:100 are just the AS in the first 16 bits and a value in the last 16.
• LOCAL_PREF and an empty AS_PATH: an iBGP update. 192.168.23.3 installs 2.2.2.2/32, but it won’t include it in its updates to any other neighbor.
• On Cisco IOS, communities are only sent when neighbor ... send-community is configured. Without it, this attribute wouldn’t be in the packet at all.