Re: distinguishing eBGP from show ip BGP

[Mark Tinka <mark.tinka () seacom mu>]

On 11/Mar/15 20:32, Reza Motamedi wrote:
> Hi Nanog,
>
> For a research I want to distinguish the external AS peering from "show ip
> BGP". In other words I want to see which entry show a path that immediately
> sends packets to another AS. My understanding is that *status code* shows
> if the route is internal, right? Does this mean if the *'i' *is not
> present, the route is goes out of the AS in the next hop. On the same note,
> can I use "Next Hop" to identify such entries?
>
> I just included a sample report from a public looking glass in XO.
>
>
>   show ip bgp  207.108.0.0/15 longer-prefixes
>   BGP table version is 529230540, local router ID is 65.106.7.145
>   * * *Status codes: s suppressed, d damped, h history, * valid, > best, i -
> internal,
>                 r RIB-failure, S Stale, m multipath, b backup-path, x
> best-external, f RT-Filter, a additional-path
>   Origin codes: i - IGP, e - EGP, ? - incomplete
>
>      Network          Next Hop            Metric LocPrf Weight Path
>   *  207.108.0.0/15   216.156.2.164            3             0 2828 209 i
>   *                   65.106.7.101             2             0 2828 209 i
>   *                   65.106.7.246             3             0 2828 209 i
>   *                   65.106.7.55              3             0 2828 209 i
>   *>                  216.156.2.162            2             0 2828 209 i
>   *                   65.106.7.54              3             0 2828 209 i
>   *                   65.106.7.252             2             0 2828 209 i
>   *                   216.156.2.160            2             0 2828 209 i
>   *                   65.106.7.56              3             0 2828 209 i
>   *                   216.156.2.165            2             0 2828 209 i
>   *                   65.106.7.144             2             0 2828 209 i

There are two uses of the "i" code in IOS:

    1. "i" for Status codes refers to the route being learned via iBGP.
    2. "i" for Origin codes refers to the route being learned via a 
locally-generated route at the origin (or more historically, the IGP).

In IOS "show ip bgp" output, the "i" for Status code (iBGP) is to the 
left of the prefix. On the other hand, the "i" for Origin code 
(IGP-originated route) is to the right of the originating AS in the AS_PATH.

So you need to be more interested in the "i" to the left of the prefix. 
In your output above, no such "i" exists; ergo, these are eBGP-learned 
routes from this router's point of view.

Use of the NEXT_HOP attribute to identify whether a route is 
eBGP-learned is not reliable, especially if you do not own the network 
you're getting your data from.

Mark.