Finding An Unknown AS Number Of BGP Peer - Who's behind the mask ?

d

Here is another CCIE Lab tip. This is another trick which I learned recently. In real world we probably don't need to learn this and this is obviously not a practical situation but here is that quick task: You need to peer with a BackBone(BB) router in order to learn tons of routes but you don't know AS number of BB router in order to peer with it. On the other hand BB router is configured properly in order to send those routes to it's peers.

Lets start with very basic config before solving this puzzle.

*********************

*      Basic Config         *

*********************

R1(config)#do sh ip int b | e do
Interface            IP-Address      OK? Method Status Protocol
FastEthernet0/0      12.12.12.1      YES manual up      up
Loopback0            11.11.11.11     YES manual up      up


R1(config)#do sh prot | e do
Global values:
  Internet Protocol routing is enabled
FastEthernet0/0 is up, line protocol is up
  Internet address is 12.12.12.1/24
Loopback0 is up, line protocol is up
  Internet address is 11.11.11.11/24


R2(config)#do sh ip int b | e do
Interface          IP-Address      OK? Method Status  Protocol
FastEthernet0/0    12.12.12.2      YES manual up      up
Loopback0          22.22.22.22     YES manual up      up


R2(config)#do sh prot | e do
Global values:
  Internet Protocol routing is enabled
FastEthernet0/0 is up, line protocol is up
  Internet address is 12.12.12.2/24
Loopback0 is up, line protocol is up
  Internet address is 22.22.22.22/24

Now lets configure Router R1 with BGP peer (As we know peer address but not AS number) with Dummy AS number. Here is the quick config:

R1(config)#do sh run | s r b
router bgp 100
 no synchronization
 bgp log-neighbor-changes
 neighbor 12.12.12.2 remote-as 1
 no auto-summary

As soon we configure BGP peer with dummy AS number 1 the following message appears on console:

R1(config)#
*Mar  1 00:09:31.019: %BGP-3-NOTIFICATION: sent to neighbor 12.12.12.2 2/2 (peer in w
rong AS) 2 bytes 00C8 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 002D 0104 00C8 00B4 161
6 1616 1002 0601 0400 0100 0102 0280 0002 0202 00
 

Here is the clue now; Look at this error message and pick the first block of Hex Characters which is 00C8. Now convert this back to Decimal using Windows Calculator(In case you are little lazy like me :-) and you will find decimal number as 200.

Now lets see if we configure BGP peer AS number as 200 and see if it works:

R1(config-router)#no neighbor 12.12.12.2 remote-as 1
R1(config-router)#neighbor 12.12.12.2 remote-as 200

and soon you will see something like this:

R1(config-router)#
*Mar  1 00:13:03.411: %BGP-5-ADJCHANGE: neighbor 12.12.12.2 Up

So magical peering comes up. But lets verify if we have received some prefix from BGP peer.

R1(config-router)#do sh ip ro b
     22.0.0.0/24 is subnetted, 1 subnets
B       22.22.22.0 [20/0] via 12.12.12.2, 00:00:33

and sure enough we do :-)

HTH...

Deepak Arora