Summary

  • Draft -03 makes integrating RFC 7606 its primary change and orders four responses to BGP UPDATE errors by scope: reset the session, disable one address family, withdraw routes in the affected UPDATE, or discard a harmless malformed attribute.
  • The narrowest response depends on what the parser can still trust: treat-as-withdraw requires readable NLRI, while attribute discard is reserved for an attribute with no effect on route selection or installation.

A malformed UPDATE arrives from a neighbor. The operator’s first question is no longer simply whether to reset the session. The sharper question is how far the damage reaches.

The October 22 version of draft-ietf-idr-bgp4-rfc4271bis makes that question part of the BGP-4 base specification. Its Appendix B says the main contribution of version 03 is integrating RFC 7606, the 2015 revision of BGP UPDATE error handling. Section 6.4.1 lays out four responses, ordered from strongest to weakest. The order is a severity ladder. The error being handled determines the response, while the draft lets implementations restore session-reset behavior by configuration.

Four sizes of trouble

At the top sits session reset. The speaker sends a NOTIFICATION and terminates the BGP session. The blast radius includes the relationship carrying every negotiated address family. Routing state then moves through the operator’s convergence and restart machinery. If the parser cannot safely locate the routes in a message, the protocol has no sound basis for pretending the damage is prefix-sized.

One step down, AFI/SAFI disable isolates an address family on that session. AFI and SAFI identify the network-layer protocol and the kind of reachability being exchanged. The draft points to the existing Multiprotocol BGP procedure that lets a speaker ignore subsequent routes for the affected family from that peer. IPv4 unicast can be the problem while IPv6 unicast keeps using the same session. The boundary is a family on one peering, not the entire neighbor relationship.

Treat-as-withdraw narrows the action to the routes carried in the UPDATE that contains the error. Those routes are removed from Adj-RIB-In as though the message had withdrawn them. That precision has a price: the receiver must parse the NLRI successfully. A router that cannot determine which prefixes were in the message cannot safely manufacture a tidy withdrawal list from it.

At the bottom is attribute discard. The malformed path attribute is thrown away and the rest of the UPDATE continues through processing. This is the least disruptive response and the most tightly fenced. The draft permits it only when the attribute has no effect on route selection or installation. Throwing away a preference, next hop or other decision-bearing value would change the route while dressing the change as cleanup.

That is the whole trick: the ladder measures response scope, while the parser’s remaining evidence determines which rung can hold. When attribute lengths conflict, the draft relies on the UPDATE’s Total Attribute Length to find the start of NLRI and calls for treat-as-withdraw unless a more severe error applies. Where the NLRI cannot be parsed with confidence, the relevant rules return to session reset.

The quiet work in version 03

RFC 7606 already introduced revised handling for malformed BGP UPDATEs. Draft -03 pulls that work into the base BGP-4 text, so implementers can read the main protocol and its error policy in one place. The revision also deprecates several old UPDATE error subcodes whose conditions no longer produce NOTIFICATIONs under the revised procedures. It changes the treatment of a semantically incorrect NEXT_HOP from “ignore” to treat-as-withdraw and allows an implementation to restore reset behavior through configuration.

RFC 7606 remains only partly folded in. Its changes to other RFCs stay outside this draft. The Datatracker lists -03 as an Active Internet-Draft in the IDR working group, with IESG state “I-D Exists”; the listed milestone is submission of the base BGP specification to the IESG in May 2027. The draft header says it updates RFC 7606 if approved. That is the live status of the text today.

A parser’s severity judgment can bill the whole peering. A session reset can widen one malformed message into a neighbor-wide event. Family disablement can leave one service’s routing on that peering with a different recovery path. Treat-as-withdraw can move traffic away from the affected prefixes while the rest of the UPDATE stream continues. Attribute discard can preserve a route while stripping information, so its safety depends on the exact attribute semantics, not on how reassuring the word “discard” sounds.

The running network supplies the test: for each error class, operators need to see the reported cause, the chosen action, the route set that changed and the forwarding consequence. A healthy Established badge answers only one question. The useful evidence is the UPDATE-level decision followed through Adj-RIB-In, the selected route, the FIB and a packet.

Sources