Re: Curious mostly about malformed updates coming from DOD ASN

Ryan Kozak via NANOG <[email protected]> Wed, 17 Jun 2026 14:18:57 +0000

Newsgroups	gmane.org.operators.nanog
Message-ID	<ETK8vf33Pq1yAzhHcfx11SsnhNxOtleT35IwhvqOuNEG2MpSSGfblnVzCOpXMtZsEitXbktfk8w2_hb23svzY9ydg2MEGlGVw7OvRpm4llM=@kozak.io>

Attribute 40 is the prefix SID attribute, from segment routing. It's valid for VPN address families but not for regular IPv4/IPv6 unicast. On those families it should just be passed as optional transitive. 

Juniper fixed a bug earlier this year where their routers were mangling this attribute when the ingress router readvertised it as a VPN route. CVE-2025-60011

I've also seen a prefix from a DOD AS with this attribute recently. 

Regards,
Ryan

-------- Original Message --------
On Wednesday, 06/17/26 at 05:18 Drew Weaver via NANOG <[email protected]> wrote:
Howdy,

I'm mostly just curious I've seen things like this before but more in the past 16 hours.

Are other folks seeing these?

Malformed UPDATE message received from neighbor (Lumen) (VRF: default) - message length 189 bytes, error flags 0x00000080, action taken "TreatAsWdr". Error details: "Error 0x00000080, Field "Attr-length", Attribute 40 (Flags 0xc0, Length 37), Data [c0282500]". NLRIs: [IPv4 Unicast] 55.27.156.0/24<http://55.27.156.0/24> 55.27.184.0/24<http://55.27.184.0/24> 55.74.158.0/24<http://55.74.158.0/24> 55.74.157.0/24<http://55.74.157.0/24> 55.67.156.0/24<http://55.67.156.0/24> 55.74.156.0/24<http://55.74.156.0/24>

I'm wondering because it could be that the update itself is fine but my router cannot interpret it properly.

Thanks everyone, sorry for noise.

-Drew

_______________________________________________
NANOG mailing list
https://lists.nanog.org/archives/list/[email protected]/message/CO4CKBL36V3WSP3KIVR3FRGLO5ATX4M7/

_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/RCX5HBYX6U3AWMZY5URQCDMMU3X7KVWU/

signature.asc (application/pgp-signature, 343 B)