BGP Route Reflector ORIGINATOR_ID and CLUSTER_LIST Packet Capture

This packet capture contains a BGP UPDATE that was reflected by a route reflector. A normal iBGP update and a reflected one look almost the same. The difference is two attributes that only a route reflector adds: ORIGINATOR_ID and CLUSTER_LIST.

Those two attributes are how iBGP prevents loops once you stop using a full mesh. The BGP route reflector lesson explains clients, clusters and the reflection rules. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The reflected UPDATE (packet 1)

Border Gateway Protocol - UPDATE Message
    Length: 70
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 42
    Path attributes
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: empty
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: AS_PATH (2)
            Length: 0
        Path Attribute - NEXT_HOP: 192.168.13.3
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: NEXT_HOP (3)
            Length: 4
            Next hop: 192.168.13.3
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - LOCAL_PREF: 100
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: LOCAL_PREF (5)
            Length: 4
            Local preference: 100
        Path Attribute - CLUSTER_LIST: 192.168.13.1
            Flags: 0x80, Optional, Non-transitive, Complete
            Type Code: CLUSTER_LIST (10)
            Length: 4
            Cluster List: 192.168.13.1
                Cluster ID: 192.168.13.1
        Path Attribute - ORIGINATOR_ID: 3.3.3.3
            Flags: 0x80, Optional, Non-transitive, Complete
            Type Code: ORIGINATOR_ID (9)
            Length: 4
            Originator identifier: 3.3.3.3
    Network Layer Reachability Information (NLRI)
        3.3.3.3/32
            NLRI prefix length: 32
            NLRI prefix: 3.3.3.3

There are a few things worth pointing out:

• AS_PATH empty and LOCAL_PREF 100: an iBGP route that was originated inside this AS. Reflection doesn’t add anything to the AS path.
• NEXT_HOP 192.168.13.3 unchanged: a route reflector doesn’t change the next hop of reflected routes.
• ORIGINATOR_ID 3.3.3.3 (type 9): the router ID of the router that put this route into iBGP. The route reflector adds it when it reflects the route. A router that receives an update with its own router ID in this attribute drops it, because it’s looking at its own route coming back.
• CLUSTER_LIST 192.168.13.1 (type 10): the cluster IDs of every route reflector that reflected this route. By default the cluster ID is the route reflector’s router ID. A route reflector that finds its own cluster ID in the list drops the update: that’s the loop check between route reflectors.
• Flags 0x80, optional non-transitive for both attributes: they only have meaning inside the AS. They’re never sent to an eBGP neighbor.