Documentation
¶
Overview ¶
Package bgp decodes BGP-4 messages per RFC 4271 plus the canonical extensions: RFC 4760 (Multiprotocol BGP / MP-BGP), RFC 5492 (Capabilities Optional Parameter), RFC 6793 (4-byte AS Number), and RFC 2918 / 7313 (Route Refresh).
Wrap-vs-native judgement
Native. RFC 4271 is fully public; BGP-4 wire format is a tight 19-byte fixed header (16-byte all-FFs Marker plus 2-byte Length plus 1-byte Type) followed by per-type bodies that are themselves bit-packed binary fields with length-prefixed sub-lists. No crypto, no compression, no varints. Operators paste BGP message bytes (TCP port 179 is the well-known port; capture a Wireshark Follow-TCP- Stream from a BGP peering session, a Quagga / FRR / GoBGP / BIRD debug log, or any BGP-speaking router's tcpdump) and get the documented header + body breakdown.
What this package covers
**19-byte fixed header** (RFC 4271 §4.1):
bytes 0-15: Marker — MUST be 16 bytes of 0xFF. The all-ones marker is a relic of the BGP-3 authentication scheme; BGP-4 still requires it for protocol fidelity. Non-conformant markers surface a Note.
bytes 16-17: Length (uint16 BE) — total message length including the 19-byte header. Min 19, max 4096 (RFC 4271 §4.1) — BGP-EXT (RFC 8654) raises the max to 65535 for some extended messages.
byte 18: **Type** with **5-entry name table**:
1 OPEN (RFC 4271 §4.2)
2 UPDATE (RFC 4271 §4.3)
3 NOTIFICATION (RFC 4271 §4.5)
4 KEEPALIVE (RFC 4271 §4.4 — empty body)
5 ROUTE-REFRESH (RFC 2918 §3 — empty payload apart from a 4-byte AFI/SAFI tuple)
**OPEN body** (RFC 4271 §4.2):
Version (1 byte; currently 4)
My Autonomous System (uint16 BE; 23456 = AS_TRANS per RFC 6793 when 4-byte AS is signalled via Capability 65)
Hold Time (uint16 BE; seconds before peer is considered dead)
BGP Identifier (4 bytes; typically a router IPv4 address)
Optional Parameters Length (1 byte)
Optional Parameters: each is Type (1) + Length (1)
Value. The most common Type is 2 (Capability) per RFC 5492, which is itself a TLV with **6-entry Capability Code name table**:
1 Multiprotocol Extensions (MP-BGP, RFC 4760)
2 Route Refresh (RFC 2918)
64 Graceful Restart (RFC 4724)
65 4-byte AS Number (RFC 6793)
67 Dynamic Capability (RFC 4396)
70 Enhanced Route Refresh (RFC 7313)
71 Long-Lived Graceful Restart (RFC 9494)
**UPDATE body** (RFC 4271 §4.3):
Withdrawn Routes Length (uint16 BE)
Withdrawn Routes (variable; list of NLRI prefixes — each is 1-byte Prefix Length + (PrefixLen/8 rounded up) prefix bytes)
Total Path Attribute Length (uint16 BE)
Path Attributes: each is Flags (1 byte: Optional / Transitive / Partial / Extended-Length) + Type Code (1 byte) + Length (1 or 2 bytes per Extended-Length flag) + Value. **9-entry Path Attribute Type name table** (RFC 4271 + 4760):
1 ORIGIN
2 AS_PATH
3 NEXT_HOP
4 MULTI_EXIT_DISC (MED)
5 LOCAL_PREF
6 ATOMIC_AGGREGATE
7 AGGREGATOR
8 COMMUNITY (RFC 1997)
14 MP_REACH_NLRI (RFC 4760)
15 MP_UNREACH_NLRI (RFC 4760)
17 AS4_PATH (RFC 6793)
18 AS4_AGGREGATOR (RFC 6793)
32 LARGE_COMMUNITY (RFC 8092)
NLRI (variable; rest of the message after path attributes; same prefix encoding as Withdrawn Routes).
**NOTIFICATION body** (RFC 4271 §4.5):
Error Code (1 byte) with **6-entry name table**: 1 Message Header Error, 2 OPEN Message Error, 3 UPDATE Message Error, 4 Hold Timer Expired, 5 Finite State Machine Error, 6 Cease (RFC 4486).
Error Subcode (1 byte) decoded per Error Code with per-code sub-tables.
Data (variable, error-code-specific diagnostic).
**KEEPALIVE body** — empty (always exactly 19 bytes total). Trailing bytes surface a non-conformance Note.
**ROUTE-REFRESH body** (RFC 2918 §3):
AFI (uint16 BE) — Address Family Identifier (e.g. 1 IPv4, 2 IPv6)
Reserved (1 byte; was Subtype in RFC 7313)
SAFI (1 byte) — Subsequent AFI (e.g. 1 unicast, 2 multicast, 4 MPLS Label, 128 VPNv4)
What this package does NOT cover (deliberately out of scope)
TCP framing — feed the bytes after a TCP/179 stream reassembly. BGP messages can span multiple TCP segments.
Path Attribute deep dissection — AS_PATH segments, COMMUNITY tuples, MP_REACH AFI/SAFI/Next-Hop/NLRI parsing — the per-attribute body is surfaced as raw hex. A future Spec would walk each attribute type.
Capability Value deep dissection — most capabilities have their own sub-format; we surface the code + length + raw value.
Route Filter / FlowSpec / RT-Constraint NLRI types — specialised AFI/SAFI combinations beyond the basic IPv4/IPv6 unicast.
Multi-message TCP-stream walking — this decoder handles a single BGP message; the caller frames the stream into messages using the 16-byte 0xFF marker and Length field.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Capability ¶
type Capability struct {
Code int `json:"code"`
CodeName string `json:"code_name"`
Length int `json:"length"`
ValueHex string `json:"value_hex,omitempty"`
}
Capability is one Capability (RFC 5492) inside a Type 2 Optional Parameter.
type KeepaliveMsg ¶
type KeepaliveMsg struct{}
KeepaliveMsg is the body of message type 4 (always empty).
type NLRIPrefix ¶
type NLRIPrefix struct {
PrefixLength int `json:"prefix_length"`
PrefixHex string `json:"prefix_hex,omitempty"`
IPv4 string `json:"ipv4,omitempty"`
}
NLRIPrefix is one (prefix-length + prefix-bytes) entry.
type NotificationMsg ¶
type NotificationMsg struct {
ErrorCode int `json:"error_code"`
ErrorCodeName string `json:"error_code_name"`
ErrorSubcode int `json:"error_subcode"`
ErrorSubcodeName string `json:"error_subcode_name,omitempty"`
DataHex string `json:"data_hex,omitempty"`
}
NotificationMsg is the body of message type 3.
type OpenMsg ¶
type OpenMsg struct {
Version int `json:"version"`
MyAS uint16 `json:"my_as"`
HoldTime uint16 `json:"hold_time_seconds"`
BGPIdentifier string `json:"bgp_identifier"`
OptParamLen int `json:"opt_param_length"`
OptParameters []OptParam `json:"opt_parameters,omitempty"`
}
OpenMsg is the body of message type 1.
type OptParam ¶
type OptParam struct {
Type int `json:"type"`
TypeName string `json:"type_name"`
Length int `json:"length"`
RawHex string `json:"raw_hex,omitempty"`
Capabilities []Capability `json:"capabilities,omitempty"`
}
OptParam is one Optional Parameter inside an OPEN message.
type PathAttribute ¶
type PathAttribute struct {
FlagsHex string `json:"flags_hex"`
Optional bool `json:"optional"`
Transitive bool `json:"transitive"`
Partial bool `json:"partial"`
ExtendedLength bool `json:"extended_length"`
Type int `json:"type"`
TypeName string `json:"type_name"`
Length int `json:"length"`
ValueHex string `json:"value_hex,omitempty"`
}
PathAttribute is one TLV in the UPDATE Path Attributes section.
type Result ¶
type Result struct {
MarkerValid bool `json:"marker_valid"`
MarkerHex string `json:"marker_hex,omitempty"`
LengthDeclared int `json:"length_declared"`
Type int `json:"type"`
TypeName string `json:"type_name"`
TotalBytes int `json:"total_bytes"`
Open *OpenMsg `json:"open,omitempty"`
Update *UpdateMsg `json:"update,omitempty"`
Notification *NotificationMsg `json:"notification,omitempty"`
Keepalive *KeepaliveMsg `json:"keepalive,omitempty"`
RouteRefresh *RouteRefreshMsg `json:"route_refresh,omitempty"`
Notes []string `json:"notes,omitempty"`
}
Result is the top-level decoded view.
type RouteRefreshMsg ¶
type RouteRefreshMsg struct {
AFI int `json:"afi"`
AFIName string `json:"afi_name"`
Reserved int `json:"reserved"`
SAFI int `json:"safi"`
SAFIName string `json:"safi_name"`
}
RouteRefreshMsg is the body of message type 5 (RFC 2918).
type UpdateMsg ¶
type UpdateMsg struct {
WithdrawnRoutesLength int `json:"withdrawn_routes_length"`
WithdrawnRoutes []NLRIPrefix `json:"withdrawn_routes,omitempty"`
TotalPathAttributeLength int `json:"total_path_attribute_length"`
PathAttributes []PathAttribute `json:"path_attributes,omitempty"`
NLRI []NLRIPrefix `json:"nlri,omitempty"`
}
UpdateMsg is the body of message type 2.
Source Files