Re: Question about normal ops - BGP Flaps nightly

[Christopher Morrow <morrowc.lists () gmail com>]

On Fri, Nov 22, 2019 at 12:54 AM Tom Beecher <beecher () beecher cc> wrote:
> I agree that this sounds like an automated process in some way.
>
> I would suspect that either a vendor code update changed something such that a given command that would not cause 
> session reset now does, or they changed their automation to include a command that would cause a reset without 
> realizing it/slipped through the cracks / etc.

thanks to some private chat with another nanog participant it was
noted the reason for failure is:
  "Error event Operation timed out(60) for I/O session - closing it"

This is fine, I suppose, except that I have v4/v6 sessions on the same
ptp link/path. So, if v6 times out I'd have expected v4 to also
timeout.
Strangely I had thought we were told the 2 links we have land on 2
different devices, but router-id tells me that's false as well. :(
The sessions appear to reset on both devices (according to syslog) at
the same time, I had thought (because our alerter is telling me) the
sessions had a gap between the 2 drops.

The physical payer is some bidi fiber path across an L2 (ether)
network to the provider, perhaps the problem isn't on the l3/bgp parts
here, but in the l2 network between. we are at the end of our time
here so I think I'll gather some logs and see if the provider can make
sense of the issues.

> On Thu, Nov 21, 2019 at 9:18 AM Mel Beckman <mel () beckman org> wrote:
> > No. There should be no reason to bounce the session. Do you have soft updates turn on?
> >
> > -mel via cell
> >
> > > On Nov 21, 2019, at 1:46 AM, Christopher Morrow <morrowc.lists () gmail com> wrote:
> > >
> > > Howdy!
> > > A question of interest to me, currently, is whether it's normal for
> > > providers to cause BGP flaps to their customers nightly... This seems,
> > > in my case, to be the provider PROBABLY updating prefix-filters on my
> > > session(s).
> > >
> > > Particularly AS56554 is currently getting v4/v6 transit from 2
> > > providers, one of which we have 2 links toward. That provider appears
> > > to flap both of our ipv6 (only) bgp peers each night at about the same
> > > time each night. This smells like: "filter updates', but something
> > > that's different than the v4 filter update? (or perhaps they have no
> > > v4 filtering to update?)
> > >
> > > In the end, should customers expect nightly (or on a regular cadence)
> > > to see their sessions bounce? It hasn't been my experience in other
> > > situations...
> > >
> > > -chris