search

DE-CIX / pbgp-parser

PCAP BGP Parser
Other
84 stars 21 forks source link

Add-Path capabilty #39

Closed cmoeller-dx closed 4 years ago

cmoeller-dx commented 4 years ago

This change allows the parser to deal with Add-Path messages. According to RFC7911, it is difficult for a packet analyzer to determine if a message contains an Add-Path field or not.

Therefore i implemented a flag which lets the user decide how a pcap should be processed. Using the --add-path-metric flag will result in the following cases:

--add-path-metric 0 : default behavior - assume there are no Add-Path fields.

--add-path-metric 1 : assume there are only Add-Path fields.

--add-path-metric 2 : Use the implemented metric to decide whether the current message contains any Add-Path fields or not (explanation below).

The first 4 bytes in a NLRI-Field can be the so called Path-Identifier (if add-path is enabled) or a address prefix. If the first 2 bytes are 0 (0byte get translated to the prefix 0.0.0.0/0) it is more likely that this is a PathID since sending two times the same prefix is uncommon.

The flag 2 feature worked pretty well so far, but be aware of possible misinterpretation of the NLRI-Field.

de-cix-role commented 4 years ago

This commit extends the pbgp parser by an add-path capability and fixes issue #37 to be able to interpret NLRI value of 0 as 0.0.0.0/0. Special thanks to @mengkoonlim and @cmoeller-dx for the support.