The customer observed the following syslog message and wanted to the impact: BGP_PREFIX_SID_ATTR_MALFORMED: Malformed bgp prefix sid attribute from peer on VRR.

rpd[10101]: %DAEMON-3-BGP_PREFIX_SID_ATTR_MALFORMED: Malformed bgp prefix sid attribute from peer: X.X.X.X (Internal AS 100) len: 28 reason: length: 1 too short to parse. 

rpd[10101]: %DAEMON-3: Total incoming malformed attributes from X.X.X.X (Internal AS 100) since last logging

rpd[10101]: %DAEMON-3: Received 1 malformed attribute PREFIX_SID(40)

rpd[10101]: %DAEMON-3-BGP_PREFIX_SID_ATTR_MALFORMED: Malformed bgp prefix sid attribute from peer: X.X.X.X (Internal AS 100) len: 28 reason: length: 1 too short to parse. 

rpd[10101]: %DAEMON-3: Received malformed update from X.X.X.X (Internal AS 100)

rpd[10101]: %DAEMON-3: Family inet-unicast, prefix 0.0.0.0/0

rpd[10101]: %DAEMON-3: Malformed Attribute PREFIX_SID(40) flag 0x00 length 1. 

rpd[10101]: %DAEMON-3: Total incoming malformed attributes from X.X.X.X (Internal AS 100) since last logging

rpd[10101]: %DAEMON-3-BGP_PREFIX_SID_ATTR_MALFORMED: Malformed bgp prefix sid attribute from peer: X.X.X.X (Internal AS 100) len: 28 reason: length: 1 too short to parse. 

rpd[10101]: %DAEMON-3: Received malformed update from X.X.X.X (Internal AS 100)

rpd[10101]: %DAEMON-3: Family inet-unicast, prefix 0.0.0.0/0

rpd[10101]: %DAEMON-3: Malformed Attribute PREFIX_SID(40) flag 0x00 length 1. 

rpd[10101]: %DAEMON-3: Total incoming malformed attributes from X.X.X.X (Internal AS 100) since last logging

rpd[10101]: %DAEMON-3: Received 1 malformed attribute PREFIX_SID(40)

Workaround:

Introduction:In BGP, the Prefix SID attribute with type code 40 plays a crucial role in path selection and propagation. However, issues can arise if routers encounter malformed Prefix SID(segment identifier) attributes from their peers. This article delves into understanding and troubleshooting such issues to ensure the stability and reliability of BGP sessions.

Understanding the Issue:
The BGP prefix SID attribute (Type Code 40) is an optional and transitive BGP path attribute. Routers that do not recognize this attribute are expected to propagate it. However, when a router detects a malformed BGP Prefix SID attribute from a peer router, it generates a syslog. This event occurs during the processing of BGP updates received from peers, indicating an issue with the Prefix SID attribute.

Troubleshooting Steps:

1. Check BGP Session Stability: Begin by checking the stability of the BGP session using the command show bgp summary. Flapping sessions could indicate underlying issues.
2. Verify Configurations: Verify the configurations on both BGP peers using show configuration. Ensure consistency and correctness in BGP settings.
3. Check Software Versions: Verify the Junos/software versions running on both routers using show version to rule out any known software bugs related to BGP Prefix SID attribute handling.
4. Enable Traceoptions: Enable traceoptions on both BGP peers to understand the packets being exchanged between them. Use the following commands:
   • set protocols bgp traceoptions file <filename>
   • set protocols bgp traceoptions flag all
   • set protocols bgp traceoptions no-remote-trace
   • set protocols bgp traceoptions flag all
   • set protocols bgp traceoptions detail
   • set protocols bgp traceoptions file size 100m
5. Packet Capture Analysis: Use packet capture tools such as tcpdump or Wireshark to capture and analyze the malformed BGP packets. This analysis can provide insights into the nature of the issue and help pinpoint the root cause.
6. Contact JTAC: Collect the above details and contact Juniper Technical Assistance Center (JTAC) for further investigation and resolution.

Note: It's important to note that the BGP session should flap after receiving malformed packets unless the bgp-error-tolerance is configured. For more information on bgp-error-tolerance, refer to Juniper's Knowledge Base article KB78389 [juniper.net].