Technical Tip: Checking AS path information in Wireshark

[Hsharma]

Description	This article describes how to check AS path information sent by the firewall to the BGP neighbor in Wireshark.
Scope	FortiGate.
Solution	FortiGate sends AS PATH to the BGP neighbor. Sometimes firewall does not represent the accurate AS PATH sent to its BGP neighbor in the advertised routes setting. Router1 # get router info bgp nei x.x.x.x advertised-route BGP table version is 13, local router ID is y.y.y.y.y Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network                       Next Hop      Metric             LocPrf         Weight        RouteTag Path ... *> 10.22.22.0/24         10.90.1.2 0                                 100                 32768                     0 16899  <-/-> From the above output, it does look like it is sending the Public AS path 16899 to its neighbor. However, there is the possibility that the neighbor could receive the private AS PATH of the FortiGate which should not be sent over globally to BGP. To check the exact AS PATH sent by FortiGate follow the below procedure. Run sniffer at port 179 for the neighbor's IP address. di sniffer packet any “host x.x.x.x and port 179 “6 0 l Keep the sniffer running and clear the BGP for that neighbor to exchange the BGP information. execute router clear bgp ip x.x.x.x soft (in/out) Stop the sniffer by CTRL+ C and download the sniffer output. Convert Sniffer output into PCAP file and analyze the PCAP through Wireshark. Refer to the following article to convert sniffer into PCAP: Technical Tip: How to import 'diagnose sniffer packet' data to WireShark - Ethereal application Here, AS PATH information can be seen in the UPDATE message. Here FortiGate is sending 16899, 65001, and 16899 as an AS PATH to its neighbor. After confirming the AS-PATH desired action can be taken depending on the network requirements. If Private AS-PATH needs to be removed, then refer to the following article:  Technical Tip: How to use 'remove-private-as' and 'set-aspath-action replace' to hide private AS in ...