Outgoing [DECODE] Open: Bad Remote-AS // Ebgp

[khaled88]

Hello team, 

I have this error message : 

BGP: 10.10.3.2-Outgoing [DECODE] Open: Bad Remote-AS (64401), expected 64400

The neighboring is UP, and the traffic is flowing as well. However, I’m concerned if there might be any issues here.

Regards,

[Atul_S]

Hi, The AS64400 seems to be invisible in Internet. Based on the error message, it represent an TCP sync packet received for BGP open message from an AS64401 when its expecting AS64400. If your BGP peering is working as expected then you may choose to ignore this error message. 

Thanks,

[Toshi_Esumi]

I would say the same as @Atul_S said. But is this AS used for your internal connection? AS 64400 and 64401 are in the public AS range and assigned to Alfanet and Rignet respectively. The 16 bit private range is 64512-65534.

Toshi

[khaled88]

Hello, 

Thank you for your answer, but How can I ignore or block these messages?

[Toshi_Esumi]

If it's from the internet, and you need to terminate BGP from your ISP (AS 64400), you can't block BGP on the interface. Unless they're overwhelming interface, it would be harmless and you can ignore.
If you still want to get rid of, you can sniff it and find out the source IP. Then look it up with "whois" and contact the sender and send an abuse complaint email to stop it. Meanwhile, you can block traffic from the source IP with a local-in-policy.

Toshi