BGP NOTIFICATION Bad Peer AS Packet Capture

Lesson Contents

This packet capture shows one of the most common BGP configuration mistakes on the wire: the AS number a neighbor announces doesn’t match the remote-as you configured for it. 192.168.12.2 sends an OPEN with My AS 2, 192.168.12.1 expects something else, and it answers with a NOTIFICATION: OPEN Message Error / Bad Peer AS. The session never comes up.

The notification even tells you which AS number it received. The BGP messages lesson covers OPEN and NOTIFICATION, and troubleshooting BGP neighbor adjacency lists the other reasons a session fails. For another OPEN error, see the BGP Role Mismatch Packet Capture. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	bgp-notification-bad-peer-as.pcapng
Packets	2
Protocol	BGP-4 (RFC 4271), OPEN and NOTIFICATION
Transport	TCP 179
Devices	Cisco IOS routers 192.168.12.1 and 192.168.12.2 (AS 2, BGP identifier 22.22.22.22)
Wireshark filter	`bgp` or `bgp.notify.minor_error_open == 2`

Packets in this capture

No.  Time      Source        Destination   Protocol  Info
1    0.000000  192.168.12.2  192.168.12.1  BGP       OPEN Message
2    0.000737  192.168.12.1  192.168.12.2  BGP       NOTIFICATION Message

Packet walkthrough

OPEN from 192.168.12.2 (packet 1)

Border Gateway Protocol - OPEN Message
    Length: 65
    Type: OPEN Message (1)
    Version: 4
    My AS: 2
    Hold Time: 180
    BGP Identifier: 22.22.22.22
    Optional Parameters Length: 36

Here’s what this packet tells us:

My AS: 2: the AS number this router announces. The receiver compares it with the remote-as in its neighbor statement.
BGP Identifier 22.22.22.22: the router ID. It doesn’t matter for this error.

NOTIFICATION from 192.168.12.1 (packet 2)

Border Gateway Protocol - NOTIFICATION Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 23
    Type: NOTIFICATION Message (3)
    Major error Code: OPEN Message Error (2)
    Minor error Code (Open Message): Bad Peer AS (2)
    Bad Peer AS: 2

Let’s walk through the highlighted fields:

Error code 2, subcode 2: OPEN Message Error, Bad Peer AS. The AS in the OPEN isn’t the one this router was told to expect.
Bad Peer AS: 2: the notification’s data field carries the AS number that was rejected. That’s why the length is 23 instead of the minimum 21: two extra bytes for AS 2.
Right after a NOTIFICATION, the TCP connection is closed. The neighbor keeps retrying, and on the router you see the session go back to Idle or Active. On Cisco IOS, the log shows a message like %BGP-3-NOTIFICATION: sent to neighbor 192.168.12.2 2/2 (peer in wrong AS) 2 bytes 0002.